Security

Report a vulnerability

SECURITY.md

Security Policy

Versions

As an open source product, we will only patch the latest major version for security vulnerabilities. Previous versions of budibase will not be retroactively patched.

Disclosing

Please report vulnerabilities via GitHub: https://github.com/Budibase/budibase/security/advisories/new

Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)
GHSA-c8vc-7pv3-g98p published Jul 22, 2026 by mjashanks

High
Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
GHSA-ppr4-5f46-j9c6 published Jul 22, 2026 by mjashanks

High
Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of GHSA-3gp5)
GHSA-mqhr-6j6h-74p5 published Jul 22, 2026 by mjashanks

Critical
SQL Injection via `multipleStatements: true` (CWE-89)
GHSA-q6x4-v3qx-85qw published Jul 22, 2026 by mjashanks

Critical
MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
GHSA-2xgg-r2wc-c5r2 published Jul 22, 2026 by mjashanks

High
SSRF via DNS rebinding in the REST datasource integration
GHSA-v42f-v8xc-j435 published Jul 22, 2026 by mjashanks

High
Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)
GHSA-pvcr-8mvp-w8qr published Jul 22, 2026 by mjashanks

High
Arbitrary File Write via retrieveDirectory S3-Key Path Traversal
GHSA-pxwc-66g3-5f27 published Jul 22, 2026 by mjashanks

Critical
Unauthenticated SQL Injection via Webhook to EXECUTE_QUERY Automation Chain
GHSA-x7h8-ww3q-xv7c published Jul 22, 2026 by mjashanks

High
Privilege escalation via public role assignment API missing app-level authorization
GHSA-j9fc-w3mr-x6mv published Jul 22, 2026 by mjashanks

High

Learn more about advisories related to Budibase/budibase in the GitHub Advisory Database