Budibase EUVD-2026-67694

Exploitation requires the attacker to hold at minimum a builder-level authenticated session in any workspace on the target Budibase instance - they do NOT need any role, membership, or invitation in the destination workspace. The attack targets POST /api/resources/duplicate with an arbitrary destination workspace ID in the request body; no special platform configuration or non-default feature flag is required in the victim workspace. The exfiltration step requires the attacker to subsequently trigger the injected automation, which they can do via standard API calls. Limiting factors: unauthenticated external attackers cannot exploit this directly, as PR:L (low privilege) authentication is required; the attacker must also know or enumerate a valid target workspace ID. No special victim-side configuration, user interaction, or elevated privilege is needed beyond having any builder account anywhere on the shared instance.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N, score 8.3) correctly captures low-privilege network exploitation with high integrity impact across both the vulnerable and subsequent systems, but materially understates risk by setting SC:N despite the CVE description explicitly describing webhook-driven data exfiltration from victim applications - subsequent-system confidentiality should be SC:H. EPSS data is absent, preventing probabilistic comparison. KEV status is not listed, meaning no confirmed active exploitation at time of analysis, and no public POC has been identified - these are distinct signals and should not be conflated. Despite the absence of a KEV listing, the attack barrier is low: any builder account on any workspace of the same platform instance serves as the entry point, with no special configuration required in the victim workspace. The cross-workspace blast radius and the exfiltration capability via a native platform feature (webhooks) elevate real-world priority well above what the SC:N vector suggests. This is a genuine high-priority finding, not a high-CVSS-but-low-real-risk case, because the exploitation path is straightforward for any insider or compromised builder account.

An attacker holding a builder account in any workspace on a Budibase instance - including a low-value or sandbox workspace - sends a crafted POST /api/resources/duplicate request with the target victim workspace ID embedded in the request body. The server injects the attacker's malicious automation, preconfigured with an outbound webhook pointing to attacker-controlled infrastructure, directly into the victim application without any role check. The attacker then triggers the automation, causing the victim application's data to be relayed externally. No public exploit code has been identified at time of analysis, but the attack requires only standard Budibase API knowledge and a valid builder session token.