CVE-2026-100687

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing...

CVE-2026-100682

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entri...

CVE-2026-100688 Budibase server before 3.45.0 Cross-Tenant Information Disclosure

Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrie...

CVE-2026-100688

Budibase server versions prior to 3.45.0 are vulnerable to a cross-tenant information disclosure vulnerability within the GET /api/applications/:appId/appPackage endpoint. The root cause is a lack of authorization checks , allowing authenticated users to access metadata and source code belonging ...

CVE-2026-100688 Budibase server before 3.45.0 Cross-Tenant Information Disclosure

Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrie...

CVE-2026-100687 Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing...

EUVD-2026-87660

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing...

CVE-2026-100687 Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing...

CVE-2026-100687 Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing...

CVE-2026-100687

The Budibase Server (versions before 3.45.0 ) contains a vulnerability where it fails to redact plaintext datasource credentials when broadcasting external table updates to the Builder collaboration websocket room . An attacker with Builder access can intercept unredacted datasource objects, whic...

EUVD-2026-87657

Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the IdP-asserted email address alone — without validatin...

CVE-2026-100684 Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC

Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the IdP-asserted email address alone — without validatin...

CVE-2026-100684 Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC

Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the IdP-asserted email address alone — without validatin...

CVE-2026-100684 Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC

Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the IdP-asserted email address alone — without validatin...

EUVD-2026-87656

Budibase @budibase/server before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string backtick-quoted for MySQL, a single-quoted sprename literal for MSSQL without applying the project's...

EUVD-2026-87655

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entri...

CVE-2026-100682

Budibase Server versions prior to 3.45.0 are vulnerable to an arbitrary file write vulnerability within the PWA icon upload endpoint . The root cause is a lack of proper symlink validation during the extraction of user-supplied ZIP archives. An attacker with the BUILDER role can exploit this by c...

CVE-2026-100682 Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entri...

CVE-2026-100682 Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entri...

CVE-2026-100682 Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entri...