Skip to content
OpenAdvisories
High WID-SEC-2026-1629 9 CVEs

Budibase: Mehrere Schwachstellen

Published May 20, 2026 · Updated May 27, 2026 · Revision 2 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um Administratorrechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.

Product

Budibase ist eine quelloffene Low-Code-Plattform für die Erstellung interner Anwendungen, wie z. B. Verwaltungspanels.

Vulnerabilities 9

  • Critical 9.0
    CVE-2026-48150

    Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign

    Budibase is an open-source low-code platform. Prior to 3.39.0, /api/public/v1/roles/assign is guarded by the builderOrAdmin middleware, which passes any user who is a builder for the app id in the x-budibase-app-id header. That check admits both global builde…

    Budibase budibase @budibase/server npm
  • High 8.5
    CVE-2026-48153

    Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata

    Budibase is an open-source low-code platform. Prior to 3.39.0, fetchToken in the OAuth2 SDK makes a POST to a builder-supplied URL with plain node-fetch, skipping the blacklist.isBlacklisted check that every other outbound fetch path in the codebase uses. The…

    Budibase budibase @budibase/server npm
  • High 8.1
    CVE-2026-48149

    Budibase: Stored XSS in Text component: BASIC users execute JS in admin session via MarkdownViewer innerHTML + CDN+srcdoc CSP bypass

    Budibase is an open-source low-code platform. Prior to 3.39.0, the Budibase Text component renders markdown by assigning marked.parse(markdown) straight to innerHTML with no sanitizer (packages/bbui/src/Markdown/MarkdownViewer.svelte:22). Any column a builder…

    Budibase budibase
  • High 8.1
    CVE-2026-48152

    Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL

    Budibase is an open-source low-code platform. Prior to 3.39.0, the single-datasource GET and PUT routes are guarded by generic TABLE READ, not by Builder/Admin permission or datasource-specific ownership/resource checks. The built-in Basic app user role maps …

    Budibase budibase @budibase/server npm
  • High 7.7
    CVE-2026-48146

    Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection

    Budibase is an open-source low-code platform. Prior to 3.39.0, the OAuth2 token fetch function in packages/server/src/sdk/workspace/oauth2/utils.ts uses raw fetch(config.url) with no SSRF protection. The safe wrapper fetchWithBlacklist() exists in the same co…

    Budibase budibase @budibase/server npm
  • High 7.5
    CVE-2026-48151

    Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema

    Budibase is an open-source low-code platform. Prior to 3.39.0, the webhook schema-building endpoint is registered under builderRoutes, but the generic authorization middleware skips authorization for all paths matching /api/webhooks/schema. As a result, an un…

    Budibase budibase @budibase/server npm
  • Medium 6.5
    CVE-2026-48147

    Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker

    Budibase is an open-source low-code platform. Prior to 3.35.4, the buildMatcherRegex() / matches() functions in packages/backend-core/src/middleware/matchers.ts route patterns are compiled into unanchored regular expressions and tested against ctx.request.url…

    Budibase budibase @budibase/backend-core npm
  • Medium 5.3
    CVE-2026-48148

    Budibase: Unvalidated VectorDB Host Parameter Enables SSRF

    Budibase is an open-source low-code platform. Prior to 3.35.3, the VectorDB configuration endpoint in Budibase accepts a host parameter that undergoes no validation against internal IP ranges, reserved hostnames, or URL schemes. Any authenticated user with bu…

    Budibase budibase @budibase/server npm
  • Medium 5.1
    CVE-2026-48128

    Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step

    Budibase is an open-source low-code platform. Prior to 3.39.0, the executeQuery automation step in Budibase accepts a queryId from automation step inputs and passes it directly to the query execution controller without additional validation. When combined wit…

    Budibase budibase budibase npm

Revision history

  1. #2

    Referenz(en) aufgenommen: CVE-2026-48153, EUVD-2026-32587, CVE-2026-48146, EUVD-2026-32593, CVE-2026-48150, EUVD-2026-32590, CVE-2026-48151, EUVD-2026-32589, CVE-2026-48152, EUVD-2026-32588, CVE-2026-48147, EUVD-2026-32606, CVE-2026-48148, EUVD-2026-32605, CVE-2026-48128, EUVD-2026-32594, CVE-2026-48149, EUVD-2026-32591

  2. #1

    Initiale Fassung

References