Budibase Server CVE-2026-73618

Exploitation requires an authenticated session with Budibase BUILDER role (query write permission) - PR:L in the CVSS 4.0 vector confirms a low-privilege authenticated user is required, not an unauthenticated attacker. The vulnerable endpoint is POST /api/v2/queries/:queryId and is only reachable when a MongoDB datasource is configured with saved parameterized queries. The specific limiting conditions are: (1) the attacker must hold or have compromised a BUILDER-level Budibase account; (2) a MongoDB-backed query with at least one user-controlled parameter must exist in the workspace. Exploitation is constrained entirely to the MongoDB database(s) connected to Budibase - it does not provide OS-level access or affect other datasource types. Anonymous or read-only (APP_USER) roles cannot trigger this endpoint.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) accurately reflects the risk profile: network-exploitable, low complexity, no user interaction, but gated by a low-privilege authentication requirement (BUILDER/query-write role). This PR:L gate is the single most important limiting factor - exploitation is not possible for anonymous users against a default deployment. EPSS data is not provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified here; however, the NoSQL injection pattern is well-understood and straightforward to execute once the prerequisite role is held, meaning internal threats or compromised BUILDER accounts represent a realistic path. The vulnerability is not in CISA KEV and no public proof-of-concept exploit has been identified, which moderates urgency relative to the high CVSS score. That said, organizations running Budibase with multiple users holding query write permissions - even a mid-sized internal deployment - should treat this as a priority patch given the direct data-manipulation impact on MongoDB collections. The availability impact is rated Low in the CVSS 4.0 vector, which is consistent: deleteMany can destroy data but does not directly affect service uptime.

An attacker who holds a Budibase BUILDER account - or has compromised one - crafts a POST request to /api/v2/queries/:queryId for a saved MongoDB query that uses a parameter such as username. By supplying the value ", "$ne": " as the parameter, the interpolated JSON becomes {"username": "", "$ne": ""}, causing MongoDB to return all documents where username is not empty rather than matching a specific user, effectively bypassing the query's intended filter. The same technique can be adapted to delete arbitrary documents using a deleteMany-backed query. No public proof-of-concept exploit has been identified at time of analysis, but the injection pattern is elementary for anyone familiar with NoSQL injection fundamentals.