EUVD-2026-25618
GHSA-8783-3wgf-jggf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
7DescriptionGitHub Advisory
Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, POST /api/global/users/search?x=/api/system/status bypasses all authentication because the regex /api/system/status/ matches in the query string portion of the URL. This vulnerability is fixed in 3.35.4.
AnalysisAI
Authentication bypass in Budibase low-code platform (versions prior to 3.35.4) allows remote unauthenticated attackers to access any protected API endpoint by appending a public endpoint path as a query parameter. The vulnerability stems from unanchored regular expressions in authentication middleware that match against the full request URL including query strings, enabling attackers to craft requests like 'POST /api/global/users/search?x=/api/system/status' to bypass all authentication checks. CVSS score of 9.1 (Critical) reflects network-based remote exploitation with no authentication or user interaction required, resulting in high confidentiality impact and high availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The vulnerability exists in Budibase's Koa-based authentication middleware implementation. The middleware uses unanchored JavaScript regular expressions to match public endpoint patterns (e.g., /api/system/status/) against ctx.request.url. In Koa framework, ctx.request.url includes both the path and query string components of the request. Because the regex patterns lack proper anchoring (start ^ and end $ anchors) and match anywhere in the string, an attacker can inject a whitelisted public endpoint pattern into the query string portion of any request. This causes the authentication middleware to incorrectly classify protected endpoints as public, completely bypassing authentication checks. The root cause maps to CWE-287 (Improper Authentication), specifically a logic error in the authentication mechanism where input validation uses overly permissive pattern matching without considering URL structure. The affected component is cpe:2.3:a:budibase:budibase, Budibase's core platform code responsible for API request authentication.
RemediationAI
Immediately upgrade to Budibase version 3.35.4 or later, which fixes the authentication bypass by implementing properly anchored regular expressions in the authentication middleware. The patch is available through standard Budibase update channels and GitHub releases. Refer to the vendor security advisory at https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf for upgrade instructions and version verification. For environments where immediate patching is not feasible, implement network-level access controls to restrict Budibase API endpoints to trusted IP ranges or place the instance behind a Web Application Firewall (WAF) configured to block requests with suspicious query parameter patterns (e.g., query strings containing '/api/' paths). Note that WAF rules are brittle workarounds prone to bypass and add latency - they should only be temporary measures until patching. Do not expose unpatched Budibase instances to the public internet under any circumstances, as the authentication bypass is trivial to exploit and grants complete API access.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Remote code execution in Budibase versions prior to 3.33.4 allows unauthenticated attackers to execute arbitrary Bash co
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today