Budibase CVE-2026-73617

Three conditions must all hold: (1) the attacker possesses a valid, authenticated BASIC user account in the target Budibase application - unauthenticated exploitation is not possible, as confirmed by PR:L in the CVSS 4.0 vector; (2) the application uses the MongoDB datasource integration - SQL, REST, and other datasource types follow a separate parameterized code path and are unaffected; (3) at least one MongoDB query is configured with Handlebars parameter bindings that incorporate user-supplied values, specifically the pattern {"field": "{{ parameterName }}"} that Budibase's own documentation recommends for per-user data scoping. Applications using MongoDB queries with fully static, hardcoded filter documents (no {{ }} bindings) are not exploitable. Limiting factors: authentication is required, only MongoDB-backed apps are in scope, and exploitation requires identifying a query that accepts user-controlled parameters - internal-only Budibase deployments with tightly managed user registration significantly reduce exposure.

The CVSS 4.0 score of 7.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N reflects network-accessible exploitation requiring only low-privilege authentication and yielding high confidentiality impact. However, the VI:L (low integrity) rating is in tension with the advisory's explicit statement that attackers can perform arbitrary collection updates and deletes - a capability that arguably warrants VI:H; security teams should verify the actual write-operation scope with the vendor before relying on the published score for prioritization. No EPSS score was provided and this CVE is not listed in the CISA KEV catalog, so no quantitative exploitation probability is available. The lack of confirmed active exploitation is partially offset by the fact that the vulnerable pattern ({"email": "{{ currentUser.email }}"}) is the Budibase-documented approach for per-user data scoping, meaning any deployment following the official guidance is exposed. Attack complexity is genuinely low once a BASIC user account is obtained - no chaining or special timing required. The primary limiting factor is the prerequisite of a valid authenticated account and the use of MongoDB datasource, which bounds blast radius compared to unauthenticated vulnerabilities.

An authenticated BASIC user submits a crafted input to a Budibase query parameter that injects a MongoDB operator - for example, supplying a value such as x", "email": {"$gt": " that exploits the Handlebars duplicate-key trick to override the builder's {"email": "{{ currentUser.email }}"} filter with {"$gt": ""}, which matches every document in the collection. Because noEscaping: true allows raw quotes and braces through and JSON.parse constructs a real object from the enriched string, the injected operator reaches collection.find() unmodified and the attacker receives all documents the database connection can access. A more privileged attacker could substitute a $where operator carrying arbitrary JavaScript to execute code within the MongoDB process, or use the same injection path against update or delete queries to modify or destroy collection data.