Budibase server versions before 3.45.0 have an authorization bypass vulnerability in the GET /api/applications/:appId/appPackage endpoint. This flaw allows authenticated users to access another tenant's application metadata and source code without proper authorization. Sensitive details exposed include navigation structure, role names, internal screen URLs, JavaScript snippets, and user identifiers.
CVE-2026-100687 is a vulnerability in Budibase Server versions before 3.45.0 where plaintext datasource credentials are exposed to unauthorized actors. This occurs because the server fails to redact sensitive information such as database passwords and API keys before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept these unredacted credentials during table save or delete operations.
Budibase server versions before 3.45.0 contain an improper privilege management vulnerability in the POST /api/global/groups/:groupId/apps endpoint. This flaw allows builders to bypass per-application authorization checks and assign themselves admin roles in other workspaces by modifying user group role mappings. The vulnerability enables privilege escalation across workspace boundaries.
Budibase server versions before 3.45.0 contain an authorization flaw in the GET /api/chat-links endpoint. This flaw allows users with builder access in one workspace to enumerate chat identity link records across all workspaces within the same tenant. Sensitive information exposed includes user IDs and external chat service identifiers from other workspaces that the attacker should not have access to.
Budibase server versions 3.41.0 up to but not including 3.45.0 contain a critical authentication bypass vulnerability in the OIDC/SSO login path. The flaw allows an attacker who can register at a trusted IdP to claim a pending user invite by asserting the victim's invited email address without proper validation of the invite code or email verification. This enables the attacker to inherit all privileges granted to the invite, including admin rights, leading to full tenant compromise and denial of onboarding to the legitimate invitee.
CVE-2026-100683 is a high-severity SQL injection vulnerability in Budibase server versions before 3.45.0. It arises from improper neutralization of special characters in SQL commands when renaming database columns via the Budibase UI. An attacker with DDL rights on a connected MySQL or MSSQL datasource can exploit this to execute arbitrary SQL statements with the privileges of Budibase's datasource user. This allows unauthorized reads, writes, or destructive operations on the connected database, bypassing Budibase's permission model. The issue is fixed in version 3.45.0.
CVE-2026-100682 is a high-severity vulnerability in Budibase Server versions before 3.45.0. It involves an arbitrary file write issue in the PWA icon upload endpoint, where user-supplied ZIP archives are extracted without proper symlink validation. Attackers with BUILDER role privileges can exploit this by crafting malicious ZIP files to write arbitrary files as root, potentially leading to remote code execution.
Budibase server versions prior to 3.45.0 contain a server-side request forgery (SSRF) vulnerability in the Microsoft Teams webhook endpoint. This flaw allows unauthenticated attackers to submit crafted POST requests with attacker-controlled serviceUrl values, which are persisted and used in subsequent bot replies. Exploitation can lead to the server sending live Microsoft OAuth access tokens to attacker-controlled hosts and enable blind internal network access. The vulnerability has a medium severity with a CVSS 4.0 score of 6.3.
Budibase server versions prior to 3.45.0 contain a vulnerability in the OpenAPI/Swagger import validator that allows authenticated builder users to read arbitrary local files. This occurs because external JSON reference resolution is not disabled, enabling attackers to embed file:// references to exfiltrate sensitive information such as environment variables, JWT secrets, API keys, and database credentials.
Budibase Server versions before 3.41.3 contain a server-side request forgery (SSRF) vulnerability in the query import endpoint. This flaw allows attackers to submit arbitrary URLs that the server fetches without proper validation, potentially exposing internal services such as cloud metadata endpoints and other restricted network resources. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.1. No known exploits are reported in the wild. A fix is available in version 3.41.3.
Budibase server versions before 3.41.3 have a missing authorization vulnerability in license management endpoints. Any authenticated user with basic privileges can access these endpoints to delete license keys or manipulate offline tokens. This allows attackers to disable premium features and downgrade deployments for all users.
Budibase server versions before 3.41.3 have a critical remote code execution vulnerability in plugin handling. Authenticated admin users can upload malicious plugin tarballs that execute arbitrary code via unsafe use of eval() on plugin JavaScript files. This flaw allows attackers to exfiltrate environment variables and credentials with root privileges in default deployments.
Budibase Server versions prior to 3.41.3 contain a server-side request forgery (SSRF) vulnerability in the datasource verify endpoint. This flaw allows builder-level users to supply arbitrary URLs without proper SSRF validation. Exploitation can lead to leakage of internal CouchDB credentials, potentially granting full database access in cloud deployments. The vulnerability has a high severity rating with a CVSS 4.0 score of 8.3.
Budibase server versions before 3.41.3 have a missing authorization vulnerability in the POST /api/resources/duplicate endpoint. This flaw allows authenticated builder users to inject tables, automations, queries, and screens into any application by specifying an arbitrary destination workspace ID, even without roles in that workspace. Injected automations can be triggered via outgoing webhooks to exfiltrate data from victim applications.
CVE-2026-82241 is a Server-Side Request Forgery (SSRF) vulnerability in the Budibase server backend-core component. The vulnerability arises because the default SSRF blacklist does not include the shared address space range 100.64.0.0/10. An authenticated user with Builder permissions can exploit this by submitting a REST datasource query preview request that targets an HTTP(S) service within this range, causing the server to send a request and return the response. No official fix was available at the time of publication; mitigation involves adding the 100.64.0.0/10 range to the blacklist.
Budibase server versions before 3.41.3 contain a missing authorization vulnerability in the public user create and update endpoints. This flaw allows authenticated app-scoped builders to escalate privileges by granting themselves builder access to unrelated applications within the same tenant. The vulnerability arises from improper validation of app-scoped builder role assignments, enabling unauthorized privilege escalation.
Budibase server versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/datasources/query endpoint. This flaw allows users with a low-privilege BASIC role to bypass per-table role restrictions and perform unauthorized read, create, update, or delete operations on any table. The vulnerability enables manipulation of restricted data by submitting crafted query requests targeting specific tables.
Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users hold by default. Attackers can specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket accessible by the stored IAM credentials, enabling unauthorized file uploads.
CVE-2026-72855 is a server-side request forgery (SSRF) vulnerability in Budibase server versions prior to 3.40.0. It affects the OpenAPI query import and REST query execution features, allowing authenticated builder-level users to bypass DNS pinning protections via DNS rebinding attacks. This enables attackers to manipulate hostname resolution to access internal HTTP services that are normally blocked. The vulnerability has a high severity score of 8.4 CVSS 4.0.
CVE-2026-72851 is a critical unauthenticated SQL injection vulnerability in Budibase server versions before 3.40.0. It occurs in webhook-triggered automations that use EXECUTE_QUERY steps, allowing attackers to send malicious JSON payloads to the webhook endpoint. Exploitation enables execution of SQL commands with builder-configured database credentials, potentially leading to data exfiltration, modification, and persistence in connected datasources such as Snowflake. A patch is available to remediate this issue.