EUVD-2026-57822
GHSA-wg7g-xr7v-hf69
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint, low complexity; PR:L because BUILDER role is required; no scope change; availability is Low since deleteMany can destroy data but not halt the service.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON structural characters to alter MongoDB queries, bypassing filters to read, modify, or delete arbitrary documents.
AnalysisAI
NoSQL injection in Budibase Server's MongoDB query execution endpoint (POST /api/v2/queries/:queryId) allows authenticated users with query write permission to bypass document-level filters and read, modify, or delete arbitrary MongoDB documents. The flaw stems from Handlebars interpolation being performed with escaping explicitly disabled (noEscaping: true), meaning JSON metacharacters in user-supplied parameters survive into the parsed query object that flows directly to MongoDB driver calls. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with Budibase BUILDER role (query write permission) - PR:L in the CVSS 4.0 vector confirms a low-privilege authenticated user is required, not an unauthenticated attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) accurately reflects the risk profile: network-exploitable, low complexity, no user interaction, but gated by a low-privilege authentication requirement (BUILDER/query-write role). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds a Budibase BUILDER account - or has compromised one - crafts a POST request to /api/v2/queries/:queryId for a saved MongoDB query that uses a parameter such as username. By supplying the value ", "$ne": " as the parameter, the interpolated JSON becomes {"username": "", "$ne": ""}, causing MongoDB to return all documents where username is not empty rather than matching a specific user, effectively bypassing the query's intended filter. … |
| Remediation | Upgrade @budibase/server to version 3.40.0 or later as described in GHSA-qw6m-8fw2-2v64 (https://github.com/Budibase/budibase/security/advisories/GHSA-qw6m-8fw2-2v64). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Budibase Server deployments and identify all users with query-write permissions; audit query execution logs for suspicious activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may injec
In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" paramet
Same technique Nosql Injection
View allShare
External POC / Exploit Code
Leaving vuln.today