Budibase Server
24 CVEs affecting Budibase Server. Latest disclosed: 2026-09-26. Critical: 3, High: 18.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-72851 | Critical | 10.0 | 2026-08-13 | Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST at… |
CVE-2026-82244 | Critical | 9.1 | 2026-08-28 | Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary cod… |
CVE-2026-72850 | Critical | 9.1 | 2026-08-13 | Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved d… |
CVE-2026-100682 | High | 8.8 | 2026-09-26 | Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without p… |
CVE-2026-72855 | High | 8.5 | 2026-08-13 | Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-l… |
CVE-2026-73618 | High | 8.3 | 2026-08-13 | Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated… |
CVE-2026-100686 | High | 8.1 | 2026-09-26 | Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign appli… |
CVE-2026-100684 | High | 8.1 | 2026-09-26 | Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing u… |
CVE-2026-100680 | High | 8.1 | 2026-09-26 | Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to… |
CVE-2026-82245 | High | 8.1 | 2026-08-28 | Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or man… |
CVE-2026-82240 | High | 8.1 | 2026-08-28 | Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scop… |
CVE-2026-82239 | High | 8.1 | 2026-08-28 | Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, cr… |
CVE-2026-100683 | High | 8.0 | 2026-09-26 | Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers di… |
CVE-2026-100685 | High | 7.7 | 2026-09-26 | Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across… |
CVE-2026-82242 | High | 7.7 | 2026-08-28 | Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders… |
CVE-2026-72859 | High | 7.7 | 2026-08-14 | Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject… |
CVE-2026-72849 | High | 7.7 | 2026-08-13 | Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat ide… |
CVE-2026-82243 | High | 7.6 | 2026-08-28 | Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply… |
CVE-2026-82246 | High | 7.1 | 2026-08-28 | Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs befor… |
CVE-2026-82241 | High | 7.1 | 2026-08-28 | Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist… |