CVE-2026-82239
Budibase before 3.41.3 Authorization Bypass via datasources/query
- State
- Published
- Severity
- 8.6 High
- Published
- Aug 28, 2026
- Updated
- Oct 8, 2026
- Reserved
- Aug 28, 2026
Description
Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query requests with target table identifiers to bypass table-level access controls and manipulate restricted data.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
serverbudibase |
|
References
- GitHub Security Advisory (GHSA-vq3j-xwg3-pg8x)vendor-advisory
- VulnCheck Advisory: Budibase before 3.41.3 Authorization Bypass via datasources/querythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.