{"kind": "version", "path": "vulns/npm/@budibase%2Fserver/3.23.32", "name": "@budibase/server", "product": "@budibase/server", "ecosystem": "npm", "version": "3.23.32", "items": [{"id": "CVE-2026-54356", "noindex": false, "published": "2026-08-17T20:32:05.691Z", "modified": "2026-08-18T13:33:04.062Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "severity": "high", "epss": 0.00352, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-54356", "title": "Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`", "description": "Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-6x9p-4r67-5gjx", "https://github.com/Budibase/budibase/releases/tag/3.41.3", "https://nvd.nist.gov/vuln/detail/CVE-2026-54356"], "fixes": [], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-35219", "noindex": false, "published": "2026-08-17T20:28:40.828Z", "modified": "2026-08-18T12:37:02.273Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00465, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-35219", "title": "Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist", "description": "Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and packages/server/src/automations/steps/discord.ts use node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement used by the REST integration, allowing an authenticated user to make server-side requests to cloud metadata and internal services. This issue is fixed in version 3.41.3.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-5fpj-28rv-84r7", "https://github.com/Budibase/budibase/pull/19328", "https://github.com/Budibase/budibase/commit/cc07563a6b0fc0f91c51aae295952b1295546a90"], "fixes": ["3.41.3"], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-73410", "noindex": false, "published": "2026-08-17T20:27:24.080Z", "modified": "2026-08-17T22:01:01.232Z", "cvss": 8.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.0028, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73410", "title": "Budibase: SSRF via DNS rebinding in the REST datasource integration", "description": "Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.ts connect to an internal address after a public address passed validation, with full response access and arbitrary REST methods. The fix adds createPinnedLookup support to the undici dispatcher and passes the validated address to custom fetch implem", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-v42f-v8xc-j435", "https://github.com/Budibase/budibase/commit/5758bdb242802ca20c4ed0dc579e4330ee898ef3", "https://nvd.nist.gov/vuln/detail/CVE-2026-73410"], "fixes": [], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-72859", "noindex": false, "published": "2026-08-14T11:35:43.574Z", "modified": "2026-10-08T15:24:37.608Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N", "severity": "high", "epss": 0.00219, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-72859", "title": "Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL", "description": "Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users hold by default. Attackers can specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket accessible by the stored IAM credentials, enabling unauthorized file uploads.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-xcx6-4f2g-hhgx", "https://www.vulncheck.com/advisories/budibase-before-authorization-regression-via-s3-presigned-url", "https://nvd.nist.gov/vuln/detail/CVE-2026-72859"], "fixes": [], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-73305", "noindex": false, "published": "2026-08-13T22:05:02.972Z", "modified": "2026-08-18T01:46:32.727Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00523, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73305", "title": "Budibase: Privilege escalation via public role assignment API missing app-level authorization", "description": "Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to an app they control and then grant themselves builder access or an arbitrary role in another app, exposing that app data, datasource configuration, and automations. This issue is fixed in version 3.39.24.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-j9fc-w3mr-x6mv", "https://github.com/Budibase/budibase/pull/19098", "https://github.com/Budibase/budibase/commit/453391d3245dd04cc386ccd6959d38ccf30db9a8"], "fixes": [], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-73304", "noindex": false, "published": "2026-08-13T22:05:00.355Z", "modified": "2026-08-14T15:09:18.395Z", "cvss": 4.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00485, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73304", "title": "Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users", "description": "Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve the identity-provider credentials of SSO-authenticated users and use the refresh tokens for persistent access to connected services. This issue is fixed in version 3.39.25.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f", "https://github.com/Budibase/budibase/pull/19110", "https://github.com/Budibase/budibase/commit/80a31f6c3354620aa90e50af8a2c614333084621"], "fixes": ["3.39.25"], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-73408", "noindex": false, "published": "2026-08-13T22:04:53.979Z", "modified": "2026-08-14T18:06:29.345Z", "cvss": 7.6, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00452, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73408", "title": "Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector", "description": "Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait for a Budibase administrator to run schema discovery, causing the second statement to execute. The fix applies quoteMySqlIdentifier before constructing the query. This issue is fixed in version 3.39.18.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-2xgg-r2wc-c5r2", "https://github.com/Budibase/budibase/pull/18989", "https://github.com/Budibase/budibase/commit/d232bd92144c768884ff8c48cb2e28673d9ffde0"], "fixes": [], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-73302", "noindex": false, "published": "2026-08-13T22:04:50.179Z", "modified": "2026-08-14T16:10:42.639Z", "cvss": 9.0, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00427, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73302", "title": "Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified", "description": "Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEmailVerified or an email_verified requirement, and packages/backend-core/src/middleware/passport/sso/sso.ts then used users.getGlobalUserByEmail as a fallback account-linking key. An attacker who can authenticate through a configured identity provider that asserts a victim email as unverified can have a fresh provider identity merged into the victim Budibase account and inherit the victim roles. This issue is fixed in version 3.39.30.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-hp6v-6jw7-gv2f", "https://github.com/Budibase/budibase/pull/19173", "https://github.com/Budibase/budibase/commit/9ecd0048d9c3ae0ee9bd0e6204c621794dd1a4d3"], "fixes": [], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-72855", "noindex": false, "published": "2026-08-13T21:54:44.625Z", "modified": "2026-10-08T15:24:37.059Z", "cvss": 8.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N", "severity": "high", "epss": 0.00375, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-72855", "title": "Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST", "description": "Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public addresses during validation but resolve to loopback or private addresses during actual connection, allowing access to blocked internal HTTP services.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-xg5g-26x8-cvf4", "https://www.vulncheck.com/advisories/budibase-before-dns-rebinding-ssrf-via-openapi-and-rest", "https://nvd.nist.gov/vuln/detail/CVE-2026-72855"], "fixes": [], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-72849", "noindex": false, "published": "2026-08-13T21:54:41.963Z", "modified": "2026-10-08T15:24:34.269Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "severity": "high", "epss": 0.00162, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-72849", "title": "Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF", "description": "Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user's account, enabling impersonation within agent operations and inheritance of victim permissions.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-pvcr-8mvp-w8qr", "https://www.vulncheck.com/advisories/budibase-before-identity-confusion-via-chat-link-handoff-csrf", "https://nvd.nist.gov/vuln/detail/CVE-2026-72849"], "fixes": [], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-73618", "noindex": false, "published": "2026-08-13T11:28:19.923Z", "modified": "2026-10-08T15:24:39.889Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00362, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73618", "title": "Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter", "description": "Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON structural characters to alter MongoDB queries, bypassing filters to read, modify, or delete arbitrary documents.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-qw6m-8fw2-2v64", "https://www.vulncheck.com/advisories/budibase-server-before-nosql-injection-via-json-parameter", "https://nvd.nist.gov/vuln/detail/CVE-2026-73618"], "fixes": [], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-73617", "noindex": false, "published": "2026-08-13T11:28:19.219Z", "modified": "2026-10-08T15:24:39.280Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00343, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73617", "title": "Budibase before 3.40.0 NoSQL Injection via MongoDB datasource", "description": "Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass per-user access controls, read arbitrary documents, execute JavaScript via $where operators, or modify collections through update and delete operations.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-pmpg-2mxq-6xwr", "https://www.vulncheck.com/advisories/budibase-before-nosql-injection-via-mongodb-datasource", "https://nvd.nist.gov/vuln/detail/CVE-2026-73617"], "fixes": [], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-73409", "noindex": false, "published": "2026-08-12T19:19:59.492Z", "modified": "2026-08-14T22:09:19.072Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00319, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73409", "title": "Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile", "description": "Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. A builder could submit absolute server paths through /api/datasources/verify and distinguish readable existing files from missing files by comparing the driver error, exposing a filesystem existence and readability oracle on the shared server. This issue is fixed in version 3.40.1.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-ppr4-5f46-j9c6", "https://github.com/Budibase/budibase/pull/19244", "https://github.com/Budibase/budibase/commit/e58aa31e18272f6a1a8aeb525b7eef0b01b1dd43"], "fixes": [], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-73407", "noindex": false, "published": "2026-08-12T19:09:55.799Z", "modified": "2026-08-12T19:30:27.096Z", "cvss": 9.0, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N", "severity": "critical", "epss": 0.0054, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73407", "title": "Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152))", "description": "Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/server/src/integrations/rest.ts attached credentials from getAuthHeaders and defaultHeaders without requiring the final request destination to match the datasource origin. An unauthenticated caller of a PUBLIC POST /api/v2/queries/:queryId query could supply an absolute or parameterized path to an attacker-controlled host and receive the stored bearer, basic, or static-header credentials. This issue is fixed in version 3.40.1.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-mqhr-6j6h-74p5", "https://github.com/Budibase/budibase/pull/19239", "https://github.com/Budibase/budibase/commit/8b1bca71501b11c68310351ef4f2c3028b2d5f08"], "fixes": [], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-73406", "noindex": false, "published": "2026-08-12T19:03:51.766Z", "modified": "2026-08-13T14:07:05.692Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00508, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73406", "title": "Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint", "description": "Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier, distinguish existing users from missing users, and obtain tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata. This issue is fixed in version 3.39.32.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-hr66-5mqr-8mpx", "https://github.com/Budibase/budibase/pull/19221", "https://github.com/Budibase/budibase/commit/0bdf648ff4c024a138a546ef84217e4efbee538e"], "fixes": [], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-73308", "noindex": false, "published": "2026-08-12T19:01:15.182Z", "modified": "2026-08-14T21:55:19.960Z", "cvss": 5.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00407, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73308", "title": "Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders", "description": "Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.user.oauth2, broadcast BuilderSocketEvent.AutomationTestProgress to the app room, and stored progress in packages/server/src/automations/testProgress.ts without user scoping. A co-builder could receive or poll another SSO-authenticated builder test and obtain OAuth2 access and refresh tokens. The fix adds sanitizeAutomationTestResult and isolates progress by user. This issue is fixed in version 3.39.25.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-gh4h-34gr-87r7", "https://github.com/Budibase/budibase/pull/19107", "https://github.com/Budibase/budibase/commit/bca426de7dc36d680285295655dc640dea2aab21"], "fixes": [], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-73307", "noindex": false, "published": "2026-08-12T18:59:52.011Z", "modified": "2026-08-12T19:46:08.763Z", "cvss": 4.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N", "severity": "medium", "epss": 0.00427, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73307", "title": "Budibase: SSRF via bare fetch() in uploadUrl during AI table generation", "description": "Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment values passed by processAttachments in packages/server/src/sdk/workspace/ai/helpers/rows.ts. A builder with the AI table-generation feature could cause an attachment value to reference an internal service or cloud metadata endpoint, and the response would be stored as an attachment without fetchWithBlacklist validation. This issue is fixed in version 3.39.4.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-hfhx-w8p8-4hc7", "https://github.com/Budibase/budibase/pull/18866", "https://github.com/Budibase/budibase/commit/fc8161e739bdc5513c4314282251e327e7fe339f"], "fixes": [], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-73306", "noindex": false, "published": "2026-08-12T18:56:08.322Z", "modified": "2026-08-13T12:18:51.707Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00438, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73306", "title": "Budibase: Account Enumeration via Login Lockout Response Differential", "description": "Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and Retry-After only for locked identifiers. An unauthenticated attacker could compare the response after repeated failures to enumerate valid email addresses and temporarily lock valid accounts. This issue is fixed in version 3.39.25.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-cr7p-cr3q-h5cm", "https://github.com/Budibase/budibase/pull/19108", "https://github.com/Budibase/budibase/commit/eaae816ab81615c07eb10e4619af078d00e2a706"], "fixes": [], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-73303", "noindex": false, "published": "2026-08-12T18:51:38.748Z", "modified": "2026-08-12T22:11:41.829Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "severity": "high", "epss": 0.00308, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73303", "title": "Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)", "description": "Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the authenticated session, while checking only currentEmail. An authenticated attacker who obtains a victim account identifier can start the email-change workflow for the victim, receive and submit the verification code through POST /api/v2/email/verification, move the victim email to an attacker-controlled address, and complete a password reset as the victim. This issue is fixed in version 3.40.0.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-c8vc-7pv3-g98p", "https://github.com/Budibase/budibase/releases/tag/3.40.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-73303"], "fixes": [], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}, {"id": "CVE-2026-73301", "noindex": false, "published": "2026-08-12T18:08:07.998Z", "modified": "2026-08-14T21:53:29.056Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00342, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73301", "title": "Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings", "description": "Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder permissions, and default-group flags. The disclosure exposes the tenant access-control structure to users who are not builders or administrators. This issue is fixed in version 3.39.25.", "references": ["https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4", "https://github.com/Budibase/budibase/pull/19109", "https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a"], "fixes": [], "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}]}], "total": 40, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "@budibase/server", "path": "vulns/npm/@budibase%2Fserver", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["3.39.25", "3.39.12", "3.39.9", "3.39.2", "3.39.0", "3.38.1", "3.35.3", "3.34.8", "3.33.4", "3.23.32", "2.20.0"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-08T15:24:39.889Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}