Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

budibase — Vulnerabilities & Security Advisories 91

Browse all 91 CVE security advisories affecting budibase. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Budibase serves as a low-code platform enabling rapid development of internal tools and business applications. Historically, the platform has been susceptible to multiple critical vulnerabilities, including remote code execution, cross-site scripting, and privilege escalation flaws, contributing to its 18 recorded CVEs. Security researchers have identified authentication bypasses and insecure default configurations as recurring issues. While no major public security incidents have been widely documented, the significant CVE count suggests potential risks for organizations implementing Budibase without rigorous hardening. Users should prioritize applying security patches and implementing additional safeguards when deploying this platform for business-critical applications.

CVE ID Title CVSS Severity Published
CVE-2026-45719 Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API — budibase CWE-94 6.5 Medium 2026-05-27
CVE-2026-46425 Budibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant users — budibase CWE-862 9.9 Critical 2026-05-27
CVE-2026-46424 Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour — budibase CWE-269 4.2 Medium 2026-05-27
CVE-2026-46426 Budibase: Unrestricted Upload of File with Dangerous Type — budibase CWE-79 7.6 High 2026-05-27
CVE-2026-46427 Budibase: Snowflake private key returned unmasked from datasource API to BASIC users — budibase CWE-200 7.7 High 2026-05-27
CVE-2026-48128 Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step — budibase CWE-918 - - 2026-05-27
CVE-2026-48146 Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection — budibase CWE-918 7.7 High 2026-05-27
CVE-2026-48149 Budibase: Stored XSS in Text component: BASIC users execute JS in admin session via MarkdownViewer innerHTML + CDN+srcdoc CSP bypass — budibase CWE-79 8.1 High 2026-05-27
CVE-2026-48150 Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign — budibase CWE-915 9.0 Critical 2026-05-27
CVE-2026-48151 Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema — budibase CWE-862 7.5 High 2026-05-27
CVE-2026-48152 Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL — budibase CWE-863 8.1 High 2026-05-27
CVE-2026-48153 Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata — budibase CWE-918 8.5 High 2026-05-27
CVE-2026-45061 Budibase: SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`) — budibase CWE-918 7.7 High 2026-05-27
CVE-2026-42239 Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover — budibase CWE-1004 8.1 High 2026-05-07
CVE-2026-41428 Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints — budibase CWE-287 9.1 Critical 2026-04-24
CVE-2026-35218 Budibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command Palette — budibase CWE-79 8.7 High 2026-04-03
CVE-2026-35216 Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step — budibase CWE-78 9.1 Critical 2026-04-03
CVE-2026-35214 Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write — budibase CWE-22 8.7 High 2026-04-03
CVE-2026-31818 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist — budibase CWE-918 9.6 Critical 2026-04-03
CVE-2026-25044 Budibase: Command Injection in Bash Automation Step — budibase CWE-78 8.8AI High AI 2026-04-03
CVE-2026-25043 Budibase: Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email Flooding — budibase CWE-770 5.3 Medium 2026-04-03
CVE-2026-33226 Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview — budibase CWE-918 8.7 High 2026-03-20
CVE-2026-31816 Budibase Universal Auth Bypass via Webhook Query Param Injection — budibase CWE-74 9.1 Critical 2026-03-09
CVE-2026-30240 Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets — budibase CWE-22 9.6 Critical 2026-03-09
CVE-2026-25045 Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role) — budibase CWE-862 8.8AI High AI 2026-03-09
CVE-2026-25737 Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS) — budibase CWE-602 8.9 High 2026-03-09
CVE-2026-25041 Budibase has a Command Injection in PostgreSQL Dump Command — budibase CWE-78 9.8AI Critical AI 2026-03-09
CVE-2026-27702 Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud) — budibase CWE-20 9.9 Critical 2026-02-25
CVE-2026-25040 Budibase Vulnerable to Privilege Escalation via API Abuse – Creator Can Invite Users with Admin/Any Role — budibase CWE-863 8.8AI High AI 2026-01-29
CVE-2023-29010 BudiBase Server-Side Request Forgery vulnerability — budibase CWE-918 6.5 Medium 2023-04-06

This page lists every published CVE security advisory associated with budibase. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.