EUVD-2026-67691
GHSA-7q8g-4mpg-9gfm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain BASIC role credentials
-
DeliverySend POST request to /api/datasources/query
-
ExploitSupply restricted table identifier in request body
-
ExecutionMissing authorization check bypassed server-side
-
ImpactRead, modify, or delete data from any application table
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid BASIC role account on the target Budibase instance - the minimum user tier. No special server configuration, no elevated permissions, and no non-default feature flag is required; the vulnerable endpoint is standard to all Budibase Server deployments prior to 3.41.3. Network access to the POST /api/datasources/query API endpoint is required, limiting exposure to attackers who can reach the Budibase API surface. The primary limiting factor is authentication: unauthenticated external attackers cannot exploit this without first obtaining a BASIC credential, which significantly reduces opportunistic mass-exploitation risk. Deployments with open BASIC user self-registration, shared BASIC credentials, or externally-reachable APIs face the highest realistic exposure. |
| Impact | The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) is well-calibrated: the attack is network-accessible, requires no special conditions, demands only a low-privilege BASIC account, and yields full confidentiality and integrity compromise against any application table. EPSS data is not present in the provided intelligence, so exploitation probability cannot be quantitatively stated. There is no CISA KEV listing, and no public exploit code has been confirmed, suggesting the vulnerability is not yet under widespread opportunistic attack. However, the near-zero technical barrier - any BASIC user can craft the bypass without tooling - means the practical risk is significantly higher than raw CVSS alone conveys for deployments where BASIC users are untrusted. Internal deployments with fully trusted user bases have substantially lower real-world exposure. This is a real priority patch, not a high-CVSS-but-low-real-risk issue. |
| Exploit ScenarioDerived | An attacker holding a valid BASIC user account on a Budibase instance - obtained via self-registration, credential phishing, or insider access - sends a crafted POST request to /api/datasources/query specifying a table identifier for a restricted table (e.g., one containing sensitive PII or financial records). The server executes the query and returns or mutates the data without checking the caller's table-level role, granting full data access that the BASIC role should be denied. The attack is repeatable for all tables in the application with no additional exploitation steps required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Authorization bypass in Budibase Server before 3.41.3 allows any authenticated user holding the lowest-privilege BASIC role to perform unrestricted read, create, update, and delete operations against any application table via the POST /api/datasources/query endpoint. Per-table role restrictions enforced elsewhere in the application are entirely absent on this API path, rendering the access control model trivially circumventable with a standard API call. No public exploit has been identified at time of analysis, though the low attack complexity - requiring only valid BASIC credentials and a crafted HTTP request - makes this a genuine priority for externally-accessible or multi-tenant deployments.
RemediationAI
Upgrade Budibase Server to version 3.41.3 or later, which introduces proper authorization enforcement on the POST /api/datasources/query endpoint. The vendor security advisory is available at https://github.com/Budibase/budibase/security/advisories/GHSA-vq3j-xwg3-pg8x. If immediate patching is not feasible, consider blocking the /api/datasources/query endpoint at a reverse proxy or WAF layer for BASIC role sessions - note this may break legitimate query workflows for those users and requires testing. Alternatively, restricting BASIC user account creation or converting existing BASIC accounts to higher roles with appropriate scoping can eliminate the exploitable privilege gap until the patch is applied. Removing external network access to the Budibase API entirely, where operationally viable, is the most conservative compensating control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Budibase is an open-source low-code platform (cpe:2.3:a:budibase:server) that provides a role-based access control model configurable at the per-table level, allowing application builders to restrict data visibility and mutability to specific user roles. CWE-862 (Missing Authorization) identifies the root cause: the POST /api/datasources/query endpoint, designed to execute database queries, lacks the server-side authorization gate that enforces table-level permissions on other data access paths. This is a classic unguarded internal API pattern - a privileged query execution path is exposed without applying the same permission checks as the primary data layer, effectively creating a bypass route. An attacker needs only to supply the target table identifier in the request body to direct queries against any table in the application.
Know when Budibase gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network-exposed API requires only a low-privilege BASIC account; no scope change occurs and no availability impact is described in the vulnerability.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query requests with target table identifiers to bypass table-level access controls and manipulate restricted data.
Executive ViewAI
Budibase Server versions prior to 3.41.3 contain an authorization bypass allowing any authenticated user with a basic-level role to directly read, create, modify, and delete data from any application table via an unprotected API endpoint. No public exploit has been identified at time of analysis; however, the low attack complexity creates significant risk for organizations using Budibase, particularly those with external users or multi-tenant environments where the authenticated user base is large.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict network access to the POST /api/datasources/query endpoint via firewall segmentation or WAF rules, disable the endpoint entirely if not operationally critical, limit endpoint access via network policies to trusted administrative systems only, implement real-time audit logging and alerting for all access to this endpoint by basic-role users, conduct forensic review of existing access logs to identify any evidence of unauthorized access, and consider implementing additional database-level access controls to minimize blast radius of any compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaS
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Unauthenticated account takeover of pending invited users in Budibase Server (@budibase/server) versions 3.41.0 through
Exploit-DB