Skip to content
OpenAdvisories
High WID-SEC-2026-1564 4 CVEs

Budibase: Mehrere Schwachstellen

Published May 17, 2026 · Updated May 27, 2026 · Revision 2 · de-DE

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um Administratorrechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen oder vertrauliche Informationen offenzulegen.

Product

Budibase ist eine quelloffene Low-Code-Plattform für die Erstellung interner Anwendungen, wie z. B. Verwaltungspanels.

Vulnerabilities 4

  • Critical 9.9
    CVE-2026-46425

    Budibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant users

    Budibase is an open-source low-code platform. Prior to 3.38.2, packages/worker/src/api/routes/global/scim.ts attaches only two middlewares to the SCIM router: requireSCIM (checks the Enterprise feature flag and SCIM config) and doInScimContext (sets the SCIM …

    Budibase budibase
  • High 7.7
    CVE-2026-46427

    Budibase: Snowflake private key returned unmasked from datasource API to BASIC users

    Budibase is an open-source low-code platform. Prior to 3.38.3, removeSecrets at packages/server/src/sdk/workspace/datasources/datasources.ts masks only datasource config fields whose schema type is DatasourceFieldType.PASSWORD. The Snowflake integration types…

    Budibase budibase
  • High 7.6
    CVE-2026-46426

    Budibase: Unrestricted Upload of File with Dangerous Type

    Budibase is an open-source low-code platform. Prior to 3.38.2, the file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for authenticated users. The checks for dangerous file extensions are conditionally wrapped insi…

    Budibase budibase budibase npm
  • Medium 4.2
    CVE-2026-46424

    Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour

    Budibase is an open-source low-code platform. Prior to 3.38.2, the public API role unassignment endpoint (POST /api/public/v1/roles/unassign) updates user documents in CouchDB but does not invalidate the corresponding Redis user cache entries. Because the aut…

    Budibase budibase @budibase/backend-core npm

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-32598, EUVD-2026-32597, EUVD-2026-32596, EUVD-2026-32595

  2. #1

    Initiale Fassung

References