https://cvebrief.com/archive/cves/vendor/budibase/ High and critical Budibase vulnerabilities covered by CVE Brief, with independent analyst commentary. en-us Sun, 30 Aug 2026 12:00:00 GMT https://cvebrief.com/cve/cve-2026-82239/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-82239 Sun, 30 Aug 2026 12:00:00 GMT Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Fix documented: 3.41.3 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-82240/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-82240 Sun, 30 Aug 2026 12:00:00 GMT Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Fix documented: 3.41.3 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-82242/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-82242 Sun, 30 Aug 2026 12:00:00 GMT Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destinatio Fix documented: 3.41.3 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-82243/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-82243 Sun, 30 Aug 2026 12:00:00 GMT Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Fix documented: 3.41.3 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-82245/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-82245 Sun, 30 Aug 2026 12:00:00 GMT Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Fix documented: 3.41.3 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-64657/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-64657 Tue, 18 Aug 2026 12:00:00 GMT Budibase is an open-source low-code platform Fix documented: 3.39.19 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-73410/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-73410 Tue, 18 Aug 2026 12:00:00 GMT Budibase is an open-source low-code platform Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72859/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-72859 Sun, 16 Aug 2026 12:00:00 GMT Budibase versions 3 Fix documented: 3.40.0 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72851/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-72851 Fri, 14 Aug 2026 12:00:00 GMT Budibase server versions before 3.40.0 contain an unauthenticated SQL injection vulnerability in webhook-triggered automations, allowing remote attackers to exfiltrate or modify database data. Fix documented: 3.40.0 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-73305/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-73305 Fri, 14 Aug 2026 12:00:00 GMT Budibase is an open-source low-code platform Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-50132/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-50132 Sun, 28 Jun 2026 12:00:00 GMT Budibase is an open-source low-code platform Fix documented: 3.39.0 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-50136/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-50136 Sun, 28 Jun 2026 12:00:00 GMT Budibase is an open-source low-code platform Fix documented: 3.39.2 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-50137/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-50137 Sat, 27 Jun 2026 12:00:00 GMT Budibase is an open-source low-code platform Fix documented: 3.39.0 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-54350/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-54350 Sat, 27 Jun 2026 12:00:00 GMT An unauthenticated injection vulnerability in Budibase allows remote attackers to read or modify arbitrary documents in connected databases via maliciously crafted query parameters. Fix documented: 3.39.12 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-54351/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-54351 Sat, 27 Jun 2026 12:00:00 GMT Budibase is an open-source low-code platform Fix documented: 3.39.9 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-54352/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-54352 Sat, 27 Jun 2026 12:00:00 GMT An improper path validation vulnerability in the Budibase PWA upload process allows authenticated builders to perform arbitrary file reads on the server. Fix documented: 3.39.9 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-54353/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-54353 Sat, 27 Jun 2026 12:00:00 GMT Budibase is an open-source low-code platform Fix documented: 3.39.9 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-48153/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-48153 Fri, 29 May 2026 12:00:00 GMT Budibase is an open-source low-code platform Fix documented: 3.39.0 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-45716/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-45716 Thu, 28 May 2026 12:00:00 GMT Budibase is an open-source low-code platform Fix documented: 3.38.1 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-45717/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-45717 Thu, 28 May 2026 12:00:00 GMT Budibase is an open-source low-code platform Fix documented: 3.38.1 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-46425/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-46425 Thu, 28 May 2026 12:00:00 GMT Budibase contains an authorization bypass vulnerability in the SCIM API, allowing authenticated users to perform unauthorized CRUD operations on all users and groups. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-42239/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-42239 Fri, 08 May 2026 12:00:00 GMT Budibase is an open-source low-code platform Fix documented: 3.35.10 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-41428/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-41428 Sat, 25 Apr 2026 12:00:00 GMT Budibase contains an authentication bypass vulnerability where unanchored regular expressions allow attackers to access protected endpoints via crafted query strings. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-31818/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-31818 Sat, 04 Apr 2026 12:00:00 GMT Budibase versions prior to 3.33.4 are vulnerable to Server-Side Request Forgery (SSRF). Fix documented: 3.33.4 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-35214/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-35214 Sat, 04 Apr 2026 12:00:00 GMT Budibase is an open-source low-code platform Fix documented: 3.33.4 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-35216/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-35216 Sat, 04 Apr 2026 12:00:00 GMT Budibase versions prior to 3.33.4 contain an unauthenticated Remote Code Execution (RCE) flaw. Fix documented: 3.33.4 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-35218/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-35218 Sat, 04 Apr 2026 12:00:00 GMT Budibase is an open-source low-code platform Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-33226/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-33226 Sat, 21 Mar 2026 12:00:00 GMT Budibase is a low code platform for creating internal tools, workflows, and admin panels Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-25737/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-25737 Tue, 10 Mar 2026 12:00:00 GMT Budibase is a low code platform for creating internal tools, workflows, and admin panels Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-30240/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-30240 Tue, 10 Mar 2026 12:00:00 GMT A path traversal vulnerability in Budibase's PWA ZIP processing allows authenticated builders to exfiltrate sensitive server files, including environment variables and encryption keys. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-31816/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-31816 Tue, 10 Mar 2026 12:00:00 GMT A regex bypass in Budibase's middleware allows unauthenticated attackers to skip all authentication and authorization checks by appending a webhook path pattern to any API request URL. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-27702/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-budibase-CVE-2026-27702 Thu, 26 Feb 2026 12:00:00 GMT Budibase Cloud suffers from an unsafe eval() vulnerability in its view filtering, allowing authenticated users to execute arbitrary JavaScript and access sensitive environment secrets. Fix documented: 3.30.4 (OSV.dev). Independent analyst report on CVE Brief.