CVE-2026-45717

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users hold by default. Attackers can specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket accessible by the stored IAM credentials, enabling unauthorized file uploads.

Budibase is an open-source low-code platform that prior to version 3.39.0 had security vulnerabilities related to access to GET and PUT routes for single data sources. Basic role users could access sensitive information such as authorization secrets by manipulating configuration data.

Budibase is an open-source low-code platform that prior to version 3.38.3 did not properly mask sensitive data in the Snowflake integration. An authenticated BASIC user could retrieve the full PEM key in plaintext.

Budibase is an open-source low-code platform. Prior to version 3.38.2, the file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for authenticated users, allowing authenticated builders to upload dangerous files.

Budibase is an open-source low-code platform that prior to version 3.38.1 had a vulnerability in the POST /api/global/users/onboard endpoint. This allows builder-level users to create new global admin accounts, leading to privilege escalation.

Budibase is an open-source low-code platform. In versions prior to 3.34.8, the processUrlFile function in extract.ts did not validate IP addresses, allowing authenticated users to send requests to internal network addresses.

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments.

Budibase prior to 3.39.30 has a vulnerability in the OIDC flow, where the email is not verified for email_verified, and accounts are linked based on email. An attacker who can authenticate through an identity provider with an unverified victim email can take over the victim's account and inherit their roles.

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources.

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing arbitrary content to any path writable by the Budibase process.