Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: budibase 3.40.0 Clear all filters
TI-2026-51082 CVE-2026-72857 · GHSA-95j2-62cr-h4p5

Budibase before 3.40.0 Credential Exposure via STRING Fields

Priority HIGH 69

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00354 Published 2026-08-13 Fixed in 3.40.0 CWE-522
TI-2026-51081 CVE-2026-72856 · GHSA-796c-884r-78pp

Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email

Priority LOW 38

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00475 Published 2026-08-13 Fixed in 3.40.0 CWE-640
TI-2026-51078 CVE-2026-72853 · GHSA-mv4c-5rgh-72q9

Budibase before 3.40.0 SQL Injection via Oracle connector

Priority HIGH 73

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers.

CVSS 4.0HIGH 8.8 Network High privileges User interaction EPSS 0.00343 Published 2026-08-13 Fixed in 3.40.0 CWE-89