CVE-2026-54350
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Budibase before version 3.39.12 contains a vulnerability that allows an unauthenticated user to read all documents from MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collections, and if a public write query exists, to modify all documents in a single HTTP request. The issue stems from improper input validation in the validateQueryInputs function, which only rejects Handlebars markers but does not escape JSON metacharacters, enabling injection of additional fields into the filter object.
Risk Assessment
The organization faces complete loss of confidentiality and integrity of data stored in supported databases. An attacker can read all records without authentication and, if a published query has the PUBLIC role, modify or delete all documents in the collection.
Recommendation
Immediately upgrade Budibase to version 3.39.12 or later. Additionally, for published apps, ensure no queries have the PUBLIC role assigned unless absolutely necessary and protected by other mechanisms.
Other vulnerabilities in Budibase
See all- CVE-2026-103757High
Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables that places an internal URL in an attachment column, causing the server to fetch it and return a presigned object-storage URL containing the response, such as cloud metadata credentials.
- CVE-2026-48152High
Budibase is an open-source low-code platform that prior to version 3.39.0 had security vulnerabilities related to access to GET and PUT routes for single data sources. Basic role users could access sensitive information such as authorization secrets by manipulating configuration data.
- CVE-2026-46427High
Budibase is an open-source low-code platform that prior to version 3.38.3 did not properly mask sensitive data in the Snowflake integration. An authenticated BASIC user could retrieve the full PEM key in plaintext.
- CVE-2026-46426High
Budibase is an open-source low-code platform. Prior to version 3.38.2, the file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for authenticated users, allowing authenticated builders to upload dangerous files.
- CVE-2026-45717High
Budibase prior to version 3.38.1 has a vulnerability in its REST API that allows authenticated app users to modify datasource configurations. Users with BASIC role or higher can send PUT requests to change settings, potentially leading to unauthorized access to sensitive data.
- CVE-2026-45716High
Budibase is an open-source low-code platform that prior to version 3.38.1 had a vulnerability in the POST /api/global/users/onboard endpoint. This allows builder-level users to create new global admin accounts, leading to privilege escalation.
- CVE-2026-45548High
Budibase is an open-source low-code platform. In versions prior to 3.34.8, the processUrlFile function in extract.ts did not validate IP addresses, allowing authenticated users to send requests to internal network addresses.
- CVE-2026-82244Critical
Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments.
- CVE-2026-73302Critical
Budibase prior to 3.39.30 has a vulnerability in the OIDC flow, where the email is not verified for email_verified, and accounts are linked based on email. An attacker who can authenticate through an identity provider with an unverified victim email can take over the victim's account and inherit their roles.
- CVE-2026-72851Critical
Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources.
Original NVD description (English source)
Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection and, where the builder has published a PUBLIC write query, modifies every document of that collection with one HTTP request. enrichContext at packages/server/src/sdk/workspace/queries/queries.ts:121-138 substitutes parameter values into the raw JSON body of a query, then JSON.parses the result. The validator validateQueryInputs at packages/server/src/api/controllers/query/index.ts:61-71 rejects only Handlebars markers ({{, }}) in user input and does not escape JSON metacharacters (", \, }). A parameter value containing a closing quote and additional keys lifts attacker-controlled fields into the parsed filter object. For Mongo find, the parsed filter passes directly to collection.find() (packages/server/src/integrations/mongodb.ts:506-510). Duplicate-key JSON parsing overrides the builder's {name: "..."} with {name: {$exists: true}} and returns every document. The same primitive against an updateMany query (mongodb.ts:577-585) widens the filter scope to the full collection while the builder-controlled $set body runs against every matched document. The authorized middleware at packages/server/src/middleware/authorized.ts:141-148 short-circuits when the query's role is PUBLIC. CSRF is not enforced on this path. POST /api/v2/queries/:queryId (packages/server/src/api/routes/query.ts:63) accepts the call with no session, only an x-budibase-app-id header that is public from the published-app URL. This vulnerability is fixed in 3.39.12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS