A missing authorization vulnerability in the Budibase server allows authenticated users to perform unauthorized resource injection and data exfiltration across isolated workspaces.

The application fails to perform adequate authorization checks on the POST /api/resources/duplicate endpoint. An authenticated builder can exploit this by specifying an arbitrary destination workspace ID, enabling the injection of tables, queries, or automations into applications where they possess no legitimate access.

This flaw carries a high CVSS score of 7.7, reflecting its potential to compromise the integrity and confidentiality of data across multiple organizational projects. An attacker could leverage injected automations to exfiltrate sensitive information via webhooks, potentially leading to significant data breaches, loss of intellectual property, and unauthorized modification of business applications.

Immediate Action: Update the Budibase server instance to version 3.41.3 or higher to ensure the authorization logic is correctly enforced.

Proactive Monitoring: Review application audit logs for unusual resource duplication requests or unexpected additions of automations and webhooks that do not align with authorized development activities.

Compensating Controls: Implement strict network egress filtering to prevent unauthorized outgoing webhooks from reaching external domains, and enforce strict workspace role-based access control policies while the update is pending.

Public Exploit Available: Unknown.

Given the potential for unauthorized data exfiltration and cross-application resource injection, organizations using Budibase should prioritize patching to version 3.41.3 immediately. Failure to address this vulnerability allows authenticated users to bypass workspace boundaries, significantly expanding the attack surface of your internal business applications.