DeutschShown in its original language — a full translation is planned for a future version.
Budibase: Mehrere Schwachstellen
view advisory published 2026-08-13
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um Dateien zu manipulieren, vertrauliche Daten offenzulegen, erweiterte Berechtigungen zu erlangen und Sicherheitsmaßnahmen zu umgehen.
01
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-82243US | high7.6 | — | ||
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs withou… | ||||
| CVE-2026-82240US | high8.1OT elevated | — | ||
Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant b… | ||||
| CVE-2026-82239US | high8.1OT elevated | — | ||
Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or dele… | ||||
| CVE-2026-54356US | —OT elevated | Exploit | ||
Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/contr… | ||||
| CVE-2026-35219US | — | — | ||
Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/z… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-468g-55qj-v8rr vom 2026-08-13external
- GitHub Security Advisory GHSA-5fpj-28rv-84r7 vom 2026-08-13external
- GitHub Security Advisory GHSA-6x9p-4r67-5gjx vom 2026-08-13external
- GitHub Security Advisory GHSA-83m5-fvmg-r7xv vom 2026-08-13external
- GitHub Security Advisory GHSA-vq3j-xwg3-pg8x vom 2026-08-13external
- WID-SEC-W-2026-2849 - CSAF Versionself
- WID-SEC-2026-2849 - Portal Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan