Skip to content
OpenAdvisories
High WID-SEC-2026-2483 7 CVEs

Budibase: Mehrere Schwachstellen

Published Jul 22, 2026 · Updated Aug 17, 2026 · Revision 4 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um erweiterte Berechtigungen zu erlangen, SQL-Injection durchzuführen, Sicherheitsmaßnahmen zu umgehen, Konten zu übernehmen, Daten zu manipulieren oder offenzulegen sowie einen Denial-of-Service-Zustand auszulösen.

Product

Budibase ist eine quelloffene Low-Code-Plattform für die Erstellung interner Anwendungen, wie z. B. Verwaltungspanels.

Vulnerabilities 7

  • Critical 9.6
    CVE-2026-73300

    Budibase: SQL Injection via `multipleStatements: true`

    Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL command…

    Budibase budibase @budibase/server npm
  • Critical 9.0
    CVE-2026-73407

    Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152))

    Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/server/src/integrations/rest.ts attached credentials from getAuthHeaders and defaultHeaders without requiring the final request destination to match the datasource…

    Budibase budibase @budibase/server npm
  • High 8.5
    CVE-2026-73410

    Budibase: SSRF via DNS rebinding in the REST datasource integration

    Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing…

    Budibase budibase @budibase/server npm
  • High 8.3
    CVE-2026-73618

    Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter

    Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query w…

    Budibase server @budibase/server npm
  • High 7.5
    CVE-2026-73406

    Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

    Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could qu…

    Budibase budibase @budibase/server npm
  • Medium 4.9
    CVE-2026-73307

    Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

    Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment values passed by processAttachments in packages/server/src/sdk/workspace/ai/helpers/rows…

    Budibase budibase @budibase/server npm
  • Medium 4.3
    CVE-2026-73301

    Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

    Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mapp…

    Budibase budibase @budibase/server npm

Revision history

  1. #4

    Referenz(en) aufgenommen: CVE-2026-73410, EUVD-2026-60380

  2. #3

    Referenz(en) aufgenommen: CVE-2026-73618, EUVD-2026-57822

  3. #2

    Referenz(en) aufgenommen: CVE-2026-73406, EUVD-2026-57433, CVE-2026-73301, EUVD-2026-57397, CVE-2026-73300, EUVD-2026-57394, CVE-2026-73407, EUVD-2026-57413, EUVD-2026-57426, CVE-2026-73307, EUVD-2026-57430

  4. #1

    Initiale Fassung

References