What is CVE-2026-82242?

CVE-2026-82242 is a high-severity vulnerability in Budibase Server, classified under Missing Authorization. CVSS score: 7.7/10. Published 2026-08-28.

How severe is CVE-2026-82242?

High severity. CVSS v3 base score is 7.7 out of 10.

Auth bypass in Budibase Server

CVE-2026-82242

Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. Attackers can inject resources by specifying an arbitrary destination workspace ID in the request body, then trigger injected automations with outgoing webhooks to exfiltrate data from victim applications.

Vulnerability class: Broken Access Control

CVSS v3 metric

CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N.

Affected products

Budibase Server

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-82242?: CVE-2026-82242 is a high-severity vulnerability in Budibase Server, classified under Missing Authorization. CVSS score: 7.7/10. Published 2026-08-28.
How severe is CVE-2026-82242?: High severity. CVSS v3 base score is 7.7 out of 10.