Budibase budibase

• CVE-2026-103757 High 7.7 Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation 0.3%
• CVE-2026-54356 High 7.1 Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url` 0.4%
• CVE-2026-35219 High 7.1 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist 0.5%
• CVE-2026-73410 High 8.5 Budibase: SSRF via DNS rebinding in the REST datasource integration 0.3%
• CVE-2026-64657 High 8.4 Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL 0.4%
• CVE-2026-73305 High 8.8 Budibase: Privilege escalation via public role assignment API missing app-level authorization 0.5%
• CVE-2026-73304 Medium 4.9 Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users 0.5%
• CVE-2026-73408 High 7.6 Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector 0.5%
• CVE-2026-73302 Critical 9.0 Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified 0.4%
• CVE-2026-72857 High 7.7 Budibase before 3.40.0 Credential Exposure via STRING Fields 0.4%
• CVE-2026-72856 High 8.1 Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email 0.5%
• CVE-2026-72853 High 7.6 Budibase before 3.40.0 SQL Injection via Oracle connector 0.3%
• CVE-2026-73409 Medium 5.1 Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile 0.3%
• CVE-2026-73407 Critical 9.0 Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152)) 0.5%
• CVE-2026-73406 High 7.5 Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint 0.5%
• CVE-2026-73308 Medium 5.7 Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders 0.4%
• CVE-2026-73307 Medium 4.9 Budibase: SSRF via bare fetch() in uploadUrl during AI table generation 0.4%
• CVE-2026-73306 Medium 5.3 Budibase: Account Enumeration via Login Lockout Response Differential 0.4%
• CVE-2026-73303 High 8.2 Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session) 0.3%
• CVE-2026-73301 Medium 4.3 Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings 0.3%
• CVE-2026-73300 Critical 9.6 Budibase: SQL Injection via `multipleStatements: true` 0.6%
• CVE-2026-67311 Medium 6.8 Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect 0.4%
• CVE-2026-54351 High 8.2 Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override 0.5%
• CVE-2026-54353 High 8.5 Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validation 0.2%
• CVE-2026-54350 Critical 10.0 Budibase: Anonymous NoSQL operator injection via published-app query templates 0.5%
• CVE-2026-50137 High 8.2 Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials 0.4%
• CVE-2026-50136 High 7.4 Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials 0.3%
• CVE-2026-50132 High 7.3 Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase 0.2%
• CVE-2026-54352 Critical 9.6 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload 0.5%
• CVE-2026-48147 Medium 6.5 Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker 0.1%
• CVE-2026-48148 Medium 5.3 Budibase: Unvalidated VectorDB Host Parameter Enables SSRF 0.2%
• CVE-2026-45548 High 7.7 Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation 0.3%
• CVE-2026-45715 High 7.7 Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration 0.3%
• CVE-2026-45716 High 8.8 Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration 0.3%
• CVE-2026-45717 High 8.8 Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL. 0.3%
• CVE-2026-45718 Medium 5.4 Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows 0.1%
• CVE-2026-45719 Medium 6.5 Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API 0.3%
• CVE-2026-46425 Critical 9.9 Budibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant users 0.3%
• CVE-2026-46424 Medium 4.2 Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour 0.2%
• CVE-2026-46426 High 7.6 Budibase: Unrestricted Upload of File with Dangerous Type 0.2%
• CVE-2026-46427 High 7.7 Budibase: Snowflake private key returned unmasked from datasource API to BASIC users 0.2%
• CVE-2026-48128 Medium 5.1 Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step 0.3%
• CVE-2026-48146 High 7.7 Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection 0.2%
• CVE-2026-48149 High 8.1 Budibase: Stored XSS in Text component: BASIC users execute JS in admin session via MarkdownViewer innerHTML + CDN+srcdoc CSP bypass 0.2%
• CVE-2026-48150 Critical 9.0 Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign 0.3%
• CVE-2026-48151 High 7.5 Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema 0.2%
• CVE-2026-48152 High 8.1 Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL 0.3%
• CVE-2026-48153 High 8.5 Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata 0.2%
• CVE-2026-45061 High 7.7 Budibase: SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`) 0.3%
• CVE-2026-42239 High 8.1 Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover 0.3%