EUVD-2026-57821
GHSA-rqxq-f5cc-3xp6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with low complexity; PR:L for required BASIC account; S:C for cross-user data scope change; I:H given explicit arbitrary update/delete capability; A:L from potential document deletion.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass per-user access controls, read arbitrary documents, execute JavaScript via $where operators, or modify collections through update and delete operations.
AnalysisAI
NoSQL injection in Budibase's MongoDB datasource integration (versions before 3.40.0) allows any authenticated BASIC user to bypass per-user query-level access controls by injecting MongoDB operators into query parameters. The root cause is Handlebars enrichment configured with noEscaping: true followed by JSON.parse, which promotes attacker-supplied $-prefixed operators directly into MongoDB query documents without filtering - enabling full collection dumps, server-side JavaScript execution via $where, and unauthorized update or delete operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must all hold: (1) the attacker possesses a valid, authenticated BASIC user account in the target Budibase application - unauthenticated exploitation is not possible, as confirmed by PR:L in the CVSS 4.0 vector; (2) the application uses the MongoDB datasource integration - SQL, REST, and other datasource types follow a separate parameterized code path and are unaffected; (3) at least one MongoDB query is configured with Handlebars parameter bindings that incorporate user-supplied values, specifically the pattern `{"field": "{{ parameterName }}"}` that Budibase's own documentation recommends for per-user data scoping. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N reflects network-accessible exploitation requiring only low-privilege authentication and yielding high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated BASIC user submits a crafted input to a Budibase query parameter that injects a MongoDB operator - for example, supplying a value such as `x", "email": {"$gt": "` that exploits the Handlebars duplicate-key trick to override the builder's `{"email": "{{ currentUser.email }}"}` filter with `{"$gt": ""}`, which matches every document in the collection. Because `noEscaping: true` allows raw quotes and braces through and `JSON.parse` constructs a real object from the enriched string, the injected operator reaches `collection.find()` unmodified and the attacker receives all documents the database connection can access. … |
| Remediation | Upgrade Budibase server to version 3.40.0 or later, which is the fix boundary stated in the CVE description. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Budibase instances and identify those running versions before 3.40.0, then immediately restrict MongoDB datasource access to trusted database administrators through role-based controls, removing query permissions for basic and general users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may injec
In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" paramet
Same technique Nosql Injection
View allShare
External POC / Exploit Code
Leaving vuln.today