CVE-2026-82239: fallo de gravedad alta en budibase server
Budibase before 3.41.3 Authorization Bypass via datasources/query
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.6epss 0.3%
Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query requests with target table identifiers to bypass table-level access controls and manipulate restricted data.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
budibase · serverCVEs relacionadas — budibase server
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-82244CRITICALBudibase before 3.41.3 Remote Code Execution via Plugin eval()EPSS 0.9%CVE-2026-100682HIGHBudibase Server before 3.45.0 Arbitrary File Write via ZIP SymlinkEPSS 0.7%CVE-2026-72850CRITICALBudibase before 3.40.0 Arbitrary File Write via Path TraversalEPSS 0.5%CVE-2026-100684CRITICALBudibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDCEPSS 0.4%CVE-2026-82245HIGHBudibase before 3.41.3 Missing Authorization License ManagementEPSS 0.4%CVE-2026-72855HIGHBudibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and RESTEPSS 0.4%