CVE-2026-46426

Budibase is an open-source low-code platform. Prior to 3.38.2, the file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for authenticated users. The checks for dangerous file extensions are conditionally wrapped inside if isPublicUser or if isPublicUser ...

CVE-2026-48153

Budibase is an open-source low-code platform. Prior to 3.39.0, fetchToken in the OAuth2 SDK makes a POST to a builder-supplied URL with plain node-fetch, skipping the blacklist.isBlacklisted check that every other outbound fetch path in the codebase uses. The Joi schema for the OAuth2 URL has no...

CVE-2026-48152

Budibase is an open-source low-code platform. Prior to 3.39.0, the single-datasource GET and PUT routes are guarded by generic TABLE READ, not by Builder/Admin permission or datasource-specific ownership/resource checks. The built-in Basic app user role maps to the WRITE permission set, which...

CVE-2026-48150

Budibase is an open-source low-code platform. Prior to 3.39.0, /api/public/v1/roles/assign is guarded by the builderOrAdmin middleware, which passes any user who is a builder for the app id in the x-budibase-app-id header. That check admits both global builders and workspace-scoped builders...

VulnCheck KEV: CVE-2026-31816

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.4 and earlier, the Budibase server's authorized middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any...

CVE-2026-54353

creationtimestamp| type| source ---|---|--- 2026-06-04 08:57:12+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-gfq7-5x4g-3xhf 2026-06-26 21:59:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7wwbufwl2l 2026-06-28 11:00:56+00:00|...

CVE-2026-54351

creationtimestamp| type| source ---|---|--- 2026-06-04 08:55:20+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-rgvg-3wpc-h44p 2026-06-26 21:52:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7wjwi2zx2m 2026-06-26 22:07:44+00:00|...

CVE-2026-46424

Budibase is an open-source low-code platform. Prior to 3.38.2, the public API role unassignment endpoint POST /api/public/v1/roles/unassign updates user documents in CouchDB but does not invalidate the corresponding Redis user cache entries. Because the authentication middleware resolves user...

CVE-2026-45718

Budibase is an open-source low-code platform. Prior to 3.38.1, the row action trigger endpoint POST /api/tables/:sourceId/actions/:actionId/trigger fails to validate that the user-supplied rowId is within the scope of the view's row filters. A user with access to a filtered view can trigger row...

CVE-2026-48149

Budibase is an open-source low-code platform. Prior to 3.39.0, the Budibase Text component renders markdown by assigning marked.parsemarkdown straight to innerHTML with no sanitizer packages/bbui/src/Markdown/MarkdownViewer.svelte:22. Any column a builder binds to a Text component in Markdown mod...

CVE-2026-45061

Budibase is an open-source low-code platform. Prior to 3.35.10, the Plugin URL upload endpoint POST /api/plugin validates the submitted URL with a single substring check: url.includes".tar.gz". Any URL containing .tar.gz anywhere in the string — in the path, query string, or fragment — passes thi...

CVE-2026-46425

Budibase is an open-source low-code platform. Prior to 3.38.2, packages/worker/src/api/routes/global/scim.ts attaches only two middlewares to the SCIM router: requireSCIM checks the Enterprise feature flag and SCIM config and doInScimContext sets the SCIM request context. There is no role check...

CVE-2026-50137

creationtimestamp| type| source ---|---|--- 2026-05-28 09:58:22+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-35c4-rvc8-frhm 2026-06-26 22:40:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7z7vspb72c 2026-06-29 14:47:17+00:00|...

CVE-2026-50136

creationtimestamp| type| source ---|---|--- 2026-05-28 09:02:01+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-jj36-r9w3-3pfh 2026-06-26 21:57:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7wsw7ek52c 2026-06-27 12:13:15+00:00|...

CVE-2026-50132

creationtimestamp| type| source ---|---|--- 2026-05-28 08:45:18+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-v7j5-vc4m-723w 2026-06-26 22:05:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7xbuj7lr2i...

CVE-2026-48147

Budibase is an open-source low-code platform. Prior to 3.35.4, the buildMatcherRegex / matches functions in packages/backend-core/src/middleware/matchers.ts route patterns are compiled into unanchored regular expressions and tested against ctx.request.url, which includes the full query string. Th...

CVE-2026-48148

Budibase is an open-source low-code platform. Prior to 3.35.3, the VectorDB configuration endpoint in Budibase accepts a host parameter that undergoes no validation against internal IP ranges, reserved hostnames, or URL schemes. Any authenticated user with builder-level access can supply an...

CVE-2026-48149

Budibase is an open-source low-code platform. Prior to 3.39.0, the Budibase Text component renders markdown by assigning marked.parsemarkdown straight to innerHTML with no sanitizer packages/bbui/src/Markdown/MarkdownViewer.svelte:22. Any column a builder binds to a Text component in Markdown mod...

CVE-2026-48152

Budibase is an open-source low-code platform. Prior to 3.39.0, the single-datasource GET and PUT routes are guarded by generic TABLE READ, not by Builder/Admin permission or datasource-specific ownership/resource checks. The built-in Basic app user role maps to the WRITE permission set, which...

CVE-2026-48150

Budibase is an open-source low-code platform. Prior to 3.39.0, /api/public/v1/roles/assign is guarded by the builderOrAdmin middleware, which passes any user who is a builder for the app id in the x-budibase-app-id header. That check admits both global builders and workspace-scoped builders...