Budibase Server CVE-2026-82243

Exploitation requires an authenticated Budibase session with builder-level privileges (PR:H per CVSS vector) - anonymous or viewer-level access is insufficient. The vulnerable code path is the datasource verify endpoint, which is accessible only to builders configuring data integrations. The attacker must also control an internet-reachable server capable of logging inbound HTTP/S requests to capture leaked credentials. Exploitation impact is highest in cloud-hosted Budibase instances where CouchDB is co-located and its credentials grant broad database access; self-hosted deployments with firewall-restricted CouchDB egress reduce but do not eliminate risk. No non-default configuration is required - the datasource verify feature is part of the standard builder workflow.

The CVSS 4.0 score of 8.3 with vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N accurately reflects the attack profile. The PR:H metric is critical context: exploitation requires an authenticated session with builder-level privileges, which is a meaningful barrier not present in lower-privilege or unauthenticated vulnerabilities. Attackers cannot exploit this from an anonymous position - they must already possess a builder account. Absent a CISA KEV listing and with no public POC identified in the available data, this appears to be a disclosure-driven finding rather than an actively exploited campaign vector. That said, the SC:H metric signals that the downstream blast radius - full CouchDB access - substantially exceeds the attacker's initial privilege level. For cloud-hosted Budibase deployments where CouchDB credentials grant broad data access, this is a genuine high-severity finding. Self-hosted deployments with network-isolated CouchDB instances face lower risk. The combination of PR:H and lack of active exploitation suggests this is a real but not immediately crisis-level priority for most organizations; cloud deployments and SaaS instances should treat it as urgent.

An attacker with a Budibase builder account navigates to the datasource configuration UI and submits a crafted datasource verify request pointing to an attacker-controlled HTTPS server. The Budibase backend processes the request and makes an outbound connection to that server, including CouchDB connection credentials in the request. The attacker's server logs the incoming request, extracts the credentials, and uses them to authenticate directly against the internal CouchDB instance, gaining full read and write access to all Budibase application data. No public POC code has been identified in the provided data.