CVE-2026-82242: falha de alta gravidade em budibase server
Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.3epss 0.4%
Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. Attackers can inject resources by specifying an arbitrary destination workspace ID in the request body, then trigger injected automations with outgoing webhooks to exfiltrate data from victim applications.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
Produtos afetados
budibase · serverCVEs relacionadas — budibase server
No mesmo produto, das mais perigosas para as menos.
CVE-2026-82244CRITICALBudibase before 3.41.3 Remote Code Execution via Plugin eval()EPSS 0.9%CVE-2026-100682HIGHBudibase Server before 3.45.0 Arbitrary File Write via ZIP SymlinkEPSS 0.7%CVE-2026-72850CRITICALBudibase before 3.40.0 Arbitrary File Write via Path TraversalEPSS 0.5%CVE-2026-100684CRITICALBudibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDCEPSS 0.4%CVE-2026-82245HIGHBudibase before 3.41.3 Missing Authorization License ManagementEPSS 0.4%CVE-2026-72855HIGHBudibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and RESTEPSS 0.4%