Vulnerability · Published Aug 28, 2026 · Assigned by VulnCheck

CVE-2026-82242Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization

High 7.7

In plain English

A high-severity missing authorization in server from budibase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.4%top 70.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. Attackers can inject resources by specifying an arbitrary destination workspace ID in the request body, then trigger injected automations with outgoing webhooks to exfiltrate data from victim applications.

Affected products (as reported)

Vendor	Product	Versions
budibase	server	0 – before 3.41.3

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

References

GitHub Security Advisory (GHSA-xqpq-288m-r5q7) vendor-advisory
VulnCheck Advisory: Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization third-party-advisory