A critical authorization bypass vulnerability in Budibase server allows low-privilege users to perform unauthorized data operations across the entire database.

This is a missing authorization flaw (CWE-862) occurring at the POST /api/datasources/query endpoint, which fails to validate permissions for BASIC role users. An authenticated attacker can manipulate or extract sensitive data from any table by submitting crafted query requests, effectively bypassing configured access restrictions.

The vulnerability carries a CVSS score of 8.1, reflecting its high potential for severe data compromise. Because the flaw permits unauthorized read, create, update, and delete actions, it poses a direct risk to data integrity, confidentiality, and business continuity. Unauthorized access to restricted tables can lead to significant regulatory exposure and operational disruption.

Immediate Action: Upgrade Budibase server to version 3.41.3 or later to ensure proper enforcement of role-based access controls on the datasource query API.

Proactive Monitoring: Review application access logs for unusual patterns of POST requests to the /api/datasources/query endpoint, specifically monitoring for query identifiers that fall outside of the expected scope for BASIC-level users.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and restrict access to the /api/datasources/query endpoint, ensuring that only expected traffic patterns are permitted until patching is completed.

Public Exploit Available: Unknown

Given the potential for full unauthorized database manipulation, this vulnerability should be prioritized for immediate remediation. Organizations using Budibase must verify their current deployment version and apply the 3.41.3 update immediately to restore critical access control boundaries and prevent unauthorized data interaction.