Security: Budibase/budibase
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope RowsGHSA-3263-v5v9-xq8q published
May 12, 2026 by mjashanksModerate -
OAuth2 Token Disclosure via Automation Test Results Broadcast to Other BuildersGHSA-gh4h-34gr-87r7 published
Jul 22, 2026 by mjashanksModerate -
Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId OverrideGHSA-rgvg-3wpc-h44p published
Jun 4, 2026 by mjashanksHigh -
Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP ConfigurationGHSA-c54j-xp92-wh28 published
May 12, 2026 by mjashanksHigh -
SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)GHSA-xh5j-727m-w6gg published
May 7, 2026 by mjashanksHigh -
SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist ProtectionGHSA-g6qx-g4pr-92v7 published
May 21, 2026 by mjashanksHigh -
CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views APIGHSA-363w-hvwh-w7m6 published
May 12, 2026 by mjashanksModerate -
SSRF Bypass via HTTP Redirect in REST Datasource IntegrationGHSA-fgqv-jh4g-pvg2 published
May 12, 2026 by mjashanksHigh -
SSRF in AI Extract File Automation Step via Missing IP Blacklist ValidationGHSA-rpj4-7x2v-wjrf published
May 11, 2026 by mjashanksHigh -
Unvalidated VectorDB Host Parameter Enables SSRFGHSA-cv96-5348-p5p8 published
May 21, 2026 by mjashanksModerate