Vulnerabilities in budibase
91 resultsCVE-2026-50136HIGHBudibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentialsEPSS 0.3%CVE-2026-46425CRITICALBudibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant usersEPSS 0.3%CVE-2026-42239HIGHBudibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeoverEPSS 0.3%CVE-2026-73410HIGHBudibase: SSRF via DNS rebinding in the REST datasource integrationEPSS 0.3%CVE-2026-103757HIGHBudibase before 3.41.0 SSRF via uploadUrl in AI Table GenerationEPSS 0.3%CVE-2026-100685HIGHBudibase before 3.45.0 Information Disclosure via Chat LinksEPSS 0.3%CVE-2026-100686HIGHBudibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/appsEPSS 0.3%CVE-2026-45719MEDIUMBudibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views APIEPSS 0.3%CVE-2026-45061HIGHBudibase: SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)EPSS 0.3%CVE-2026-100683HIGHBudibase before 3.45.0 SQL Injection via column-rename DDLEPSS 0.3%CVE-2026-45716HIGHBudibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP ConfigurationEPSS 0.3%CVE-2026-45548HIGHBudibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist ValidationEPSS 0.3%CVE-2026-45715HIGHBudibase: SSRF Bypass via HTTP Redirect in REST Datasource IntegrationEPSS 0.3%CVE-2026-48152HIGHBudibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URLEPSS 0.3%CVE-2026-100687HIGHBudibase Server before 3.45.0 Credential Exposure via External Table BroadcastEPSS 0.3%CVE-2026-45717HIGHBudibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL.EPSS 0.3%CVE-2026-48149HIGHBudibase: Stored XSS in Text component: BASIC users execute JS in admin session via MarkdownViewer innerHTML + CDN+srcdoc CSP bypassEPSS 0.2%CVE-2026-48148MEDIUMBudibase: Unvalidated VectorDB Host Parameter Enables SSRFEPSS 0.2%CVE-2026-48151HIGHBudibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schemaEPSS 0.2%CVE-2026-46427HIGHBudibase: Snowflake private key returned unmasked from datasource API to BASIC usersEPSS 0.2%