CVE-2026-122244

Description Summary A low-privileged application end-user role "BASIC" - not a builder or admin, and on a public data-collection form, an unauthenticated visitor can store an HTML/JavaScript payload in ordinary row data. When a builder or admin later opens that table in the Budibase Builder and...