Budibase
CVE-2026-31816
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft request with webhook path in query string
-
DeliveryBypass authorized() middleware regex check
-
ExploitSkip authentication and authorization
-
ExecutionAccess protected API endpoint
-
ImpactRetrieve or modify sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against Budibase versions 3.31.4 and earlier. Attacker appends webhook path pattern to query string of any server-side API endpoint request. |
| Impact | CVSS 9.1. Authorization bypass + injection = unauthenticated access to all Budibase data. |
| Exploit ScenarioDerived | Attacker bypasses auth middleware and injects malicious content to access or modify business application data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection attacks. PoC available.
Earlier versions of this analysis (1)
Auth middleware bypass with injection in Budibase.
RemediationAI
Update Budibase.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-74 injection through authorization bypass. The server's authorized() middleware is flawed.
Know when Budibase gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.4 and earlier, the Budibase server's authorized() middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any request. The isWebhookEndpoint() function uses an unanchored regex that tests against ctx.request.url, which in Koa includes the full URL with query parameters. When the regex matches, the authorized() middleware immediately calls return next(), skipping all authentication, authorization, role checks, and CSRF protection. This means a completely unauthenticated, remote attacker can access any server-side API endpoint by simply appending ?/webhooks/trigger (or any webhook pattern variant) to the URL.
Executive ViewAI
A critical vulnerability (CVSS 9.1) in Budibase allows attackers to potentially compromise internal tools, workflows, and admin panels used across your organization. Organizations using Budibase for business-critical operations face immediate risk of unauthorized access, data exfiltration, or system manipulation until remediation is implemented.
Implement network segmentation to restrict Budibase instance access to authorized users only; deploy WAF rules to monitor and block suspicious requests to Budibase endpoints; enforce multi-factor authentication for all Budibase admin accounts; increase logging and alerting for Budibase access and configuration changes; consider disabling non-critical Budibase deployments until patch availability; require VPN access for all Budibase interactions; monitor for indicators of compromise related to this CVE.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in Budibase Multiple Security Flaws
View all 5Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaS
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Unauthenticated account takeover of pending invited users in Budibase Server (@budibase/server) versions 3.41.0 through
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Exploit-DB