Budibase - Authentication Bypass

Budibase = 3.31.4 contains an authentication bypass caused by unanchored regex in authorized middleware matching webhook path patterns in query strings, letting unauthenticated remote attackers access any server-side API endpoint, exploit requires crafted request with webhook pattern in URL. id:...

CVE-2026-31816-rshell

CVE-2026-31816 Reverse Shell Exploit Обзор Этот инструмент использует CVE-2026-31816 для установления обратного соединения reverse shell с целевым сервером Budibase. Цепочка атаки : Обход аутентификации → Загрузка плагина DATASOURCE → Выполнение кода на стороне сервера → Обратная оболочка Reverse...

CVE-2026-103757

Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables...

CVE-2026-103757

Budibase versions prior to 3.41.0 are vulnerable to a Server-Side Request Forgery (SSRF) flaw within the AI table generation feature. The root cause is located in the uploadUrl function in packages/server/src/utilities/fileUtils.ts, which incorrectly utilizes the raw node-fetch library instead of...

CVE-2026-103757 Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation

Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables...

EUVD-2026-90686

Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables...

CVE-2026-103757 Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation

Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables...

CVE-2026-103757 Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation

Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables...

CVE-2026-54350-Budibase-NoSQL-Injection

CVE-2026-54350 — Injection d'opérateur NoSQL non authentifiée dans Budibase Injection d'opérateur JSON/NoSQL non authentifiée dans Budibase. Tout visiteur anonyme d'une application Budibase publiée qui expose une requête PUBLIQUE soutenue par une source de données documentaire MongoDB, CouchDB,...

CVE-2026-54356

CVE-2026-54356 — Budibase: выпуск аутентифицированным пользователем произвольной подписанной S3-ссылки на загрузку Аутентифицированный пользователь опубликованного рабочего пространства Budibase с низкими привилегиями роль BASIC может вызвать POST /api/attachments/:datasourceId/url и получить...

CVE-2026-31816

CVE-2026-31816 - Bypass de autenticación a RCE en Budibase CVE-2026-31816 es una vulnerabilidad crítica de bypass de autenticación y autorización que afecta a Budibase. La vulnerabilidad se encuentra en el middleware de autorización del lado del servidor responsable de proteger los endpoints de l...

CVE-2026-100688

Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrie...

CVE-2026-100687

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing...

CVE-2026-100686

Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant...

CVE-2026-100682

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entri...

CVE-2026-100683

Budibase @budibase/server before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string backtick-quoted for MySQL, a single-quoted sprename literal for MSSQL without applying the project's...

CVE-2026-100685

Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data includin...

CVE-2026-100681

Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an...

CVE-2026-100680

Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI specifications submitted to the import...

CVE-2026-100684

Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the IdP-asserted email address alone — without validatin...