Security: Budibase/budibase
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)GHSA-c8vc-7pv3-g98p published
Jul 22, 2026 by mjashanksHigh -
Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFileGHSA-ppr4-5f46-j9c6 published
Jul 22, 2026 by mjashanksHigh -
Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of GHSA-3gp5)GHSA-mqhr-6j6h-74p5 published
Jul 22, 2026 by mjashanksCritical -
SQL Injection via `multipleStatements: true` (CWE-89)GHSA-q6x4-v3qx-85qw published
Jul 22, 2026 by mjashanksCritical -
MySQL DESCRIBE Backtick Injection via multipleStatements in Database ConnectorGHSA-2xgg-r2wc-c5r2 published
Jul 22, 2026 by mjashanksHigh -
SSRF via DNS rebinding in the REST datasource integrationGHSA-v42f-v8xc-j435 published
Jul 22, 2026 by mjashanksHigh -
Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)GHSA-pvcr-8mvp-w8qr published
Jul 22, 2026 by mjashanksHigh -
Arbitrary File Write via retrieveDirectory S3-Key Path TraversalGHSA-pxwc-66g3-5f27 published
Jul 22, 2026 by mjashanksCritical -
Unauthenticated SQL Injection via Webhook to EXECUTE_QUERY Automation ChainGHSA-x7h8-ww3q-xv7c published
Jul 22, 2026 by mjashanksHigh -
Privilege escalation via public role assignment API missing app-level authorizationGHSA-j9fc-w3mr-x6mv published
Jul 22, 2026 by mjashanksHigh