CVE-2026-72857

Budibase before 3.40.0 has a credential exposure weakness: it does not redact credentials stored in STRING fields, enabling authenticated users with table read permissions to read MongoDB connection strings and Firebase private keys via the read API, effectively exposing live backend credentials ...