Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

budibase — Vulnerabilities & Security Advisories 91

Browse all 91 CVE security advisories affecting budibase. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Budibase serves as a low-code platform enabling rapid development of internal tools and business applications. Historically, the platform has been susceptible to multiple critical vulnerabilities, including remote code execution, cross-site scripting, and privilege escalation flaws, contributing to its 18 recorded CVEs. Security researchers have identified authentication bypasses and insecure default configurations as recurring issues. While no major public security incidents have been widely documented, the significant CVE count suggests potential risks for organizations implementing Budibase without rigorous hardening. Users should prioritize applying security patches and implementing additional safeguards when deploying this platform for business-critical applications.

Found 24 results / 91 Clear Filters
CVE ID Title CVSS Severity Published
CVE-2026-100688 Budibase server before 3.45.0 Cross-Tenant Information Disclosure — server CWE-639 6.5 Medium 2026-09-26
CVE-2026-100686 Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps — server CWE-269 8.1 High 2026-09-26
CVE-2026-100687 Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast — server CWE-200 5.5 Medium 2026-09-26
CVE-2026-100685 Budibase before 3.45.0 Information Disclosure via Chat Links — server CWE-863 7.7 High 2026-09-26
CVE-2026-100683 Budibase before 3.45.0 SQL Injection via column-rename DDL — server CWE-89 8.0 High 2026-09-26
CVE-2026-100684 Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC — server CWE-287 8.1 High 2026-09-26
CVE-2026-100682 Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink — server CWE-22 8.8 High 2026-09-26
CVE-2026-100681 Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook — server CWE-918 5.4 Medium 2026-09-26
CVE-2026-100680 Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import — server CWE-200 8.1 High 2026-09-26
CVE-2026-82246 Budibase Server before 3.41.3 SSRF via Query Import — server CWE-918 7.1 High 2026-08-28
CVE-2026-82245 Budibase before 3.41.3 Missing Authorization License Management — server CWE-862 8.1 High 2026-08-28
CVE-2026-82244 Budibase before 3.41.3 Remote Code Execution via Plugin eval() — server CWE-94 9.1 Critical 2026-08-28
CVE-2026-82243 Budibase Server before 3.41.3 SSRF with Credential Leakage — server CWE-918 7.6 High 2026-08-28
CVE-2026-82242 Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization — server CWE-862 7.7 High 2026-08-28
CVE-2026-82241 Budibase backend-core SSRF via incomplete default blacklist — server CWE-918 7.1 High 2026-08-28
CVE-2026-82240 Budibase before 3.41.3 Privilege Escalation via User Update API — server CWE-862 8.1 High 2026-08-28
CVE-2026-82239 Budibase before 3.41.3 Authorization Bypass via datasources/query — server CWE-862 8.1 High 2026-08-28
CVE-2026-72859 Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL — server CWE-863 7.7 High 2026-08-14
CVE-2026-72855 Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST — server CWE-918 8.5 High 2026-08-13
CVE-2026-72850 Budibase before 3.40.0 Arbitrary File Write via Path Traversal — server CWE-22 9.1 Critical 2026-08-13
CVE-2026-72851 Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook — server CWE-89 10.0 Critical 2026-08-13
CVE-2026-72849 Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF — server CWE-352 7.7 High 2026-08-13
CVE-2026-73618 Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter — server CWE-943 8.3 High 2026-08-13
CVE-2026-73617 Budibase before 3.40.0 NoSQL Injection via MongoDB datasource — server CWE-943 7.1 High 2026-08-13

This page lists every published CVE security advisory associated with budibase. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.