Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

budibase — Vulnerabilities & Security Advisories 91

Browse all 91 CVE security advisories affecting budibase. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Budibase serves as a low-code platform enabling rapid development of internal tools and business applications. Historically, the platform has been susceptible to multiple critical vulnerabilities, including remote code execution, cross-site scripting, and privilege escalation flaws, contributing to its 18 recorded CVEs. Security researchers have identified authentication bypasses and insecure default configurations as recurring issues. While no major public security incidents have been widely documented, the significant CVE count suggests potential risks for organizations implementing Budibase without rigorous hardening. Users should prioritize applying security patches and implementing additional safeguards when deploying this platform for business-critical applications.

CVE ID Title CVSS Severity Published
CVE-2026-72853 Budibase before 3.40.0 SQL Injection via Oracle connector — budibase CWE-89 7.6 High 2026-08-13
CVE-2026-72851 Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook — server CWE-89 10.0 Critical 2026-08-13
CVE-2026-72850 Budibase before 3.40.0 Arbitrary File Write via Path Traversal — server CWE-22 9.1 Critical 2026-08-13
CVE-2026-72849 Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF — server CWE-352 7.7 High 2026-08-13
CVE-2026-73618 Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter — server CWE-943 8.3 High 2026-08-13
CVE-2026-73617 Budibase before 3.40.0 NoSQL Injection via MongoDB datasource — server CWE-943 7.1 High 2026-08-13
CVE-2026-73409 Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile — budibase CWE-203 5.1 Medium 2026-08-12
CVE-2026-73407 Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152)) — budibase CWE-22 9.0 Critical 2026-08-12
CVE-2026-73406 Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint — budibase CWE-200 7.5 High 2026-08-12
CVE-2026-73308 Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders — budibase CWE-200 5.7 Medium 2026-08-12
CVE-2026-73307 Budibase: SSRF via bare fetch() in uploadUrl during AI table generation — budibase CWE-918 4.9 Medium 2026-08-12
CVE-2026-73306 Budibase: Account Enumeration via Login Lockout Response Differential — budibase CWE-204 5.3 Medium 2026-08-12
CVE-2026-73303 Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session) — budibase CWE-639 8.2 High 2026-08-12
CVE-2026-73301 Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings — budibase CWE-862 4.3 Medium 2026-08-12
CVE-2026-73300 Budibase: SQL Injection via `multipleStatements: true` — budibase CWE-89 9.6 Critical 2026-08-12
CVE-2026-67311 Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect — budibase CWE-918 6.8 Medium 2026-08-01
CVE-2026-54351 Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override — budibase CWE-915 8.2 High 2026-06-26
CVE-2026-54353 Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validation — budibase CWE-367 8.5 High 2026-06-26
CVE-2026-54350 Budibase: Anonymous NoSQL operator injection via published-app query templates — budibase CWE-89 10.0 Critical 2026-06-26
CVE-2026-50137 Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials — budibase CWE-862 - - 2026-06-26
CVE-2026-50136 Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials — budibase CWE-306 7.4 High 2026-06-26
CVE-2026-50132 Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase — budibase CWE-284 7.3 High 2026-06-26
CVE-2026-54352 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload — budibase CWE-22 9.6 Critical 2026-06-26
CVE-2026-48147 Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker — budibase CWE-185 6.5 Medium 2026-05-27
CVE-2026-48148 Budibase: Unvalidated VectorDB Host Parameter Enables SSRF — budibase CWE-918 - - 2026-05-27
CVE-2026-45548 Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation — budibase CWE-918 7.7 High 2026-05-27
CVE-2026-45715 Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration — budibase CWE-918 7.7 High 2026-05-27
CVE-2026-45716 Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration — budibase CWE-269 8.8 High 2026-05-27
CVE-2026-45717 Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL. — budibase CWE-862 8.8 High 2026-05-27
CVE-2026-45718 Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows — budibase CWE-863 5.4 Medium 2026-05-27

This page lists every published CVE security advisory associated with budibase. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.