CVE-2026-72853
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.
Risk Assessment
The risk includes unauthorized access to data and the ability to modify it in the Oracle database, potentially compromising data integrity and confidentiality.
Recommendation
Upgrade Budibase to version 3.40.0 or later to remediate the SQL injection vulnerability.
Original NVD description (English source)
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.