Vulnerabilities

TI-2026-39243 CVE-2026-54351 · GHSA-rgvg-3wpc-h44p

Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override

HIGH 76

Budibase is an open-source low-code platform.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00461 Published 2026-06-26 Fixed in 3.39.9 CWE-915

TI-2026-39245 CVE-2026-54353 · GHSA-gfq7-5x4g-3xhf

Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validation

HIGH 70

Budibase is an open-source low-code platform.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00213 Published 2026-06-26 Fixed in 3.39.9 CWE-367

TI-2026-39242 CVE-2026-54350 · GHSA-8qv3-p479-cj62

Budibase: Anonymous NoSQL operator injection via published-app query templates

HIGH 82

Budibase is an open-source low-code platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00538 Published 2026-06-26 Fixed in 3.39.12 CWE-89

TI-2026-36908 CVE-2026-50137 · GHSA-35c4-rvc8-frhm

Missing authorization in budibase

HIGH 71

Budibase is an open-source low-code platform.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00415 Published 2026-06-26 Fixed in 3.39.0 CWE-862

TI-2026-36907 CVE-2026-50136 · GHSA-jj36-r9w3-3pfh

Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials

HIGH 66

Budibase is an open-source low-code platform.

CVSS 3.1HIGH 7.4 Network Low privileges No interaction EPSS 0.0029 Published 2026-06-26 Fixed in 3.39.3, 3.39.2 CWE-306

TI-2026-36903 CVE-2026-50132 · GHSA-v7j5-vc4m-723w

Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase

HIGH 67

Budibase is an open-source low-code platform.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00192 Published 2026-06-26 Fixed in 3.39.0 CWE-284

TI-2026-39244 CVE-2026-54352 · GHSA-w7mq-r738-x278

Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload

HIGH 76

Budibase is an open-source low-code platform.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00494 Published 2026-06-26 Fixed in 3.39.9 CWE-22

TI-2026-30560 CVE-2026-42239 · GHSA-4f9j-vr4p-642r

Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover

HIGH 70

Budibase is an open-source low-code platform.

CVSS 3.1HIGH 8.1 Network High privileges User interaction EPSS 0.00283 Published 2026-05-07 Fixed in 3.35.10 CWE-1004

TI-2026-30027 CVE-2026-41428 · GHSA-8783-3wgf-jggf

Improper authentication in budibase

HIGH 72

Budibase is an open-source low-code platform.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00445 Published 2026-04-24 Fixed in 3.35.4 CWE-287

TI-2026-27371 CVE-2026-35218

Budibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command Palette

HIGH 73

Budibase is an open-source low-code platform.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00335 Published 2026-04-03 Fixed in 3.32.5 CWE-79

TI-2026-27369 CVE-2026-35216 · GHSA-fcm4-4pj2-m5hf

Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step

HIGH 74

Budibase is an open-source low-code platform.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.10904 Published 2026-04-03 Fixed in 3.33.4 CWE-78

TI-2026-27367 CVE-2026-35214 · GHSA-2wfh-rcwf-wh23

Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write

HIGH 71

Budibase is an open-source low-code platform.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.00564 Published 2026-04-03 Fixed in 3.33.4 CWE-22

TI-2026-24371 CVE-2026-31818 · GHSA-7r9j-r86q-7g45

Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist

HIGH 76

Budibase is an open-source low-code platform.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00383 Published 2026-04-03 Fixed in 3.33.4 CWE-1188

TI-2026-20228 CVE-2026-25044 · GHSA-gjw9-34gf-rp6m

Budibase: Command Injection in Bash Automation Step

MEDIUM 46

Budibase is an open-source low-code platform.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00474 Published 2026-04-03 Fixed in 3.33.4 CWE-78

TI-2026-20227 CVE-2026-25043

Budibase: Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email Flooding

HIGH 72

Budibase is an open-source low-code platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00302 Published 2026-04-03 Fixed in 3.23.25 CWE-770

TI-2026-25645 CVE-2026-33226 · GHSA-4647-wpjq-hh7f

Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview

HIGH 73

Budibase is a low code platform for creating internal tools, workflows, and admin panels.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.00381 Published 2026-03-20 No fix listed CWE-918

TI-2026-24369 CVE-2026-31816

Budibase Universal Auth Bypass via Webhook Query Param Injection

HIGH 80

Budibase is a low code platform for creating internal tools, workflows, and admin panels.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.16683 Published 2026-03-09 No fix listed CWE-74

TI-2026-23473 CVE-2026-30240

Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets

HIGH 76

Budibase is a low code platform for creating internal tools, workflows, and admin panels.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00292 Published 2026-03-09 No fix listed CWE-22

TI-2026-20229 CVE-2026-25045

Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role)

HIGH 73

Budibase is a low code platform for creating internal tools, workflows, and admin panels.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0034 Published 2026-03-09 No fix listed CWE-862

TI-2026-20805 CVE-2026-25737

Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)

HIGH 74

Budibase is a low code platform for creating internal tools, workflows, and admin panels.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00308 Published 2026-03-09 No fix listed CWE-602

TI-2026-20226 CVE-2026-25041 · GHSA-726g-59wr-cj4c

Budibase has a Command Injection in PostgreSQL Dump Command

MEDIUM 40

Budibase is a low code platform for creating internal tools, workflows, and admin panels.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00546 Published 2026-03-09 Fixed in 3.23.32 CWE-78

TI-2026-22078 CVE-2026-27702 · GHSA-rvhr-26g4-p2r8

Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)

HIGH 76

Budibase is a low code platform for creating internal tools, workflows, and admin panels.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00391 Published 2026-02-25 Fixed in 3.30.4 CWE-20

TI-2026-20225 CVE-2026-25040

Budibase Vulnerable to Privilege Escalation via API Abuse – Creator Can Invite Users with Admin/Any Role

LOW 26

Budibase is a low code platform for creating internal tools, workflows, and admin panels.

CVSS 4.0MEDIUM 5.7 Network Low privileges No interaction EPSS 0.00568 Published 2026-01-29 No fix listed CWE-863

TI-2023-13471 CVE-2023-29010

BudiBase Server-Side Request Forgery vulnerability

MEDIUM 62

Budibase is a low code platform for creating internal tools, workflows, and admin panels.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00647 Published 2023-04-06 Fixed in 2.4.3 CWE-918

TI-2022-02980 CVE-2022-3225 · GHSA-x92g-49gh-63qm

Improper Control of Dynamically-Managed Code Resources in budibase/budibase

MEDIUM 40

Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00959 Published 2022-09-16 Fixed in 1.3.20 CWE-913

Vulnerabilities

Filters