Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100688Budibase server before 3.45.0 Cross-Tenant Information Disclosure

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in server from budibase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 73.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrieve sensitive application details including navigation structure, role names, internal screen URLs, JavaScript snippets, and user identifiers without authorization checks.

Affected products (as reported)

Vendor	Product	Versions
budibase	server	0 – before 3.45.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-4946-qf2m-wrh5) vendor-advisory
VulnCheck Advisory: Budibase server before 3.45.0 Cross-Tenant Information Disclosure third-party-advisory