PT-2026-71910

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...

PT-2026-71911

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner changeTenantOwnerEmail endpoint. On self-hosted instances SELF HOSTED or DISABLE ACCOUNT PORTAL set, the cloudRestricted middleware is a no-op and the route is protected only b...

PT-2026-71912

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

PT-2026-71913

Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEmailVerified or an email verified requirement, and packages/backend-core/src/middleware/passport/sso/sso.ts then used...

PT-2026-71916

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait...

PT-2026-71914

Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve...

PT-2026-71906

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...

PT-2026-71907

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing...

PT-2026-71908

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...

CVE-2026-73306

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:36+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-cr7p-cr3q-h5cm...

CVE-2026-73302

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:31+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-hp6v-6jw7-gv2f 2026-08-13 23:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msyrsuqm3p2t...

CVE-2026-73304

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:28+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f...

CVE-2026-73305

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:26+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-j9fc-w3mr-x6mv 2026-08-14 01:01:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msyxhdipyh26...

CVE-2026-73301

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:23+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4...

CVE-2026-73307

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:17+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-hfhx-w8p8-4hc7...

CVE-2026-73308

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:15+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-gh4h-34gr-87r7...

CVE-2026-73406

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:13+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-hr66-5mqr-8mpx 2026-08-12 21:01:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msvzmlg3ko22...

CVE-2026-73409

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:08+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-ppr4-5f46-j9c6...

CVE-2026-73410

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:06+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-v42f-v8xc-j435...

CVE-2026-73406

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLICENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier,...