CVE-2026-100681
Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook
- State
- Published
- Severity
- 6.3 Medium
- Published
- Sep 26, 2026
- Updated
- Oct 8, 2026
- Reserved
- Sep 26, 2026
Description
Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an attacker-controlled serviceUrl that is persisted and used for all subsequent bot replies, causing the server to send live Microsoft OAuth access tokens in Authorization headers to the attacker's host and enabling blind internal network access.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
serverbudibase |
|
References
- GitHub Security Advisory (GHSA-942w-fccr-8r3c)vendor-advisory
- VulnCheck Advisory: Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhookthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.