Budibase vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-103757 Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilitHigh 8.3 · Oct 1, 2026
• CVE-2026-100688 Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows aHigh 7.1 · Sep 26, 2026
• CVE-2026-100687 Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocketHigh 7 · Sep 26, 2026
• CVE-2026-100686 Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign applicHigh 8.6 · Sep 26, 2026
• CVE-2026-100685 Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across aHigh 8.3 · Sep 26, 2026
• CVE-2026-100684 Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server.Critical 9.2 · Sep 26, 2026
• CVE-2026-100683 Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers dirHigh 8.9 · Sep 26, 2026
• CVE-2026-100682 Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without prHigh 8.7 · Sep 26, 2026
• CVE-2026-100680 Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to rHigh 8.6 · Sep 26, 2026
• CVE-2026-82246 Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs beforeHigh 7.1 · Aug 28, 2026
• CVE-2026-82245 Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or maniHigh 7.2 · Aug 28, 2026
• CVE-2026-82244 Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary codeCritical 9.4 · Aug 28, 2026
• CVE-2026-82243 Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply aHigh 8.3 · Aug 28, 2026
• CVE-2026-82242 Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders tHigh 8.3 · Aug 28, 2026
• CVE-2026-82241 Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist (High 7.1 · Aug 28, 2026
• CVE-2026-82240 Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scopeHigh 8.6 · Aug 28, 2026
• CVE-2026-82239 Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, creHigh 8.6 · Aug 28, 2026
• CVE-2026-73410 Budibase is an open-source low-code platform.High 8.5 · Aug 17, 2026
• CVE-2026-64657 Budibase is an open-source low-code platform.High 8.4 · Aug 17, 2026
• CVE-2026-54356 Budibase is an open-source low-code platform.High 7.1 · Aug 17, 2026
• CVE-2026-35219 Budibase is an open-source low-code platform.High 7.1 · Aug 17, 2026
• CVE-2026-72859 Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject pHigh 8.3 · Aug 14, 2026
• CVE-2026-73408 Budibase is an open-source low-code platform.High 7.6 · Aug 13, 2026
• CVE-2026-73305 Budibase is an open-source low-code platform.High 8.8 · Aug 13, 2026
• CVE-2026-73302 Budibase is an open-source low-code platform.Critical 9 · Aug 13, 2026