Vulnerability · Published Aug 28, 2026 · Assigned by VulnCheck

CVE-2026-82239Budibase before 3.41.3 Authorization Bypass via datasources/query

High 8.1

In plain English

A high-severity missing authorization in server from budibase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 71.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query requests with target table identifiers to bypass table-level access controls and manipulate restricted data.

Affected products (as reported)

Vendor	Product	Versions
budibase	server	0 – before 3.41.3

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-vq3j-xwg3-pg8x) vendor-advisory
VulnCheck Advisory: Budibase before 3.41.3 Authorization Bypass via datasources/query third-party-advisory