CVE-2026-48152
HighSummary
Budibase is an open-source low-code platform that prior to version 3.39.0 had security vulnerabilities related to access to GET and PUT routes for single data sources. Basic role users could access sensitive information such as authorization secrets by manipulating configuration data.
Risk Assessment
Organizations may be exposed to the disclosure of confidential authorization data, potentially leading to unauthorized access to resources and data. Attackers could exploit this vulnerability to gain control over applications using Budibase.
Recommendation
It is recommended to update Budibase to version 3.39 or later to eliminate this vulnerability. Additionally, conducting an audit of user permissions and application security is advisable.
Other vulnerabilities in Budibase
See all- CVE-2026-46427High
Budibase is an open-source low-code platform that prior to version 3.38.3 did not properly mask sensitive data in the Snowflake integration. An authenticated BASIC user could retrieve the full PEM key in plaintext.
- CVE-2026-46426High
Budibase is an open-source low-code platform. Prior to version 3.38.2, the file upload endpoint POST /api/attachments/process does not enforce active-content restrictions for authenticated users, allowing authenticated builders to upload dangerous files.
- CVE-2026-45717High
Budibase prior to version 3.38.1 has a vulnerability in its REST API that allows authenticated app users to modify datasource configurations. Users with BASIC role or higher can send PUT requests to change settings, potentially leading to unauthorized access to sensitive data.
- CVE-2026-45716High
Budibase is an open-source low-code platform that prior to version 3.38.1 had a vulnerability in the POST /api/global/users/onboard endpoint. This allows builder-level users to create new global admin accounts, leading to privilege escalation.
- CVE-2026-45548High
Budibase is an open-source low-code platform. In versions prior to 3.34.8, the processUrlFile function in extract.ts did not validate IP addresses, allowing authenticated users to send requests to internal network addresses.
- CVE-2026-82244Critical
Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments.
- CVE-2026-73302Critical
Budibase prior to 3.39.30 has a vulnerability in the OIDC flow, where the email is not verified for email_verified, and accounts are linked based on email. An attacker who can authenticate through an identity provider with an unverified victim email can take over the victim's account and inherit their roles.
- CVE-2026-72851Critical
Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources.
- CVE-2026-72850Critical
Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing arbitrary content to any path writable by the Budibase process.
- CVE-2026-73407Critical
Budibase prior to 3.40.1 did not verify that the final request destination matches the datasource origin, allowing an unauthenticated caller of a public query endpoint to supply an attacker-controlled host and receive stored credentials. This issue is fixed in version 3.40.1.
Original NVD description (English source)
Budibase is an open-source low-code platform. Prior to 3.39.0, the single-datasource GET and PUT routes are guarded by generic TABLE READ, not by Builder/Admin permission or datasource-specific ownership/resource checks. The built-in Basic app user role maps to the WRITE permission set, which includes table read/write and query write. A Basic user can therefore read an existing REST datasource, receive redacted authConfigs values, submit an update that changes only config.url while keeping the redacted placeholders, and trigger an existing saved relative-path REST query. During update, mergeConfigs() restores the old stored secret when it sees the redaction placeholder. During query execution, Budibase prefixes the attacker-controlled datasource config.url to the relative query path and applies the resolved stored auth headers. The result is server-side disclosure of the builder-configured REST Authorization secret to an attacker-controlled listener. This vulnerability is fixed in 3.39