DeutschShown in its original language — a full translation is planned for a future version.
Budibase: Mehrere Schwachstellen
view advisory published 2026-07-22
Ein Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um erweiterte Berechtigungen zu erlangen, SQL-Injection durchzuführen, Sicherheitsmaßnahmen zu umgehen, Konten zu übernehmen, Daten zu manipulieren oder offenzulegen sowie einen Denial-of-Service-Zustand auszulösen.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-73410US | — | — | ||
Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integr… | ||||
| CVE-2026-73618US | — | — | ||
Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templ… | ||||
| CVE-2026-73407US | — | — | ||
Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/server/src/integrations/rest.ts attached credentials from getAuthHeaders and default… | ||||
| CVE-2026-73406US | — | — | ||
Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserL… | ||||
| CVE-2026-73307US | — | — | ||
Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment values pa… | ||||
| CVE-2026-73301US | —OT elevated | — | ||
Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin,… | ||||
| CVE-2026-73300US | — | — | ||
Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multip… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-2xgg-r2wc-c5r2 vom 2026-07-22external
- GitHub Security Advisory GHSA-4qcj-m5wp-jmf4 vom 2026-07-22external
- GitHub Security Advisory GHSA-c8vc-7pv3-g98p vom 2026-07-22external
- GitHub Security Advisory GHSA-fcrw-f7gg-6g9f vom 2026-07-22external
- GitHub Security Advisory GHSA-hfhx-w8p8-4hc7 vom 2026-07-22external
- GitHub Security Advisory GHSA-hp6v-6jw7-gv2f vom 2026-07-22external
- GitHub Security Advisory GHSA-hr66-5mqr-8mpx vom 2026-07-22external
- GitHub Security Advisory GHSA-j9fc-w3mr-x6mv vom 2026-07-22external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan