UpHeron
All posts

Critical vulnerabilities

7 critical vulnerabilities in Budibase

7 vulnerabilities rated critical (CVSS 9.0 or higher) found on 10 November 2026: Budibase (7).

  • 7 critical

Budibase

7 vulnerabilities · Servers and applications · most fixed in 4.0.0

  1. 10.0Anonymous MongoDB filter erasure through dynamic __proto__ keys in PUBLIC query templatesFixed in 4.0.0GHSA-x4w8-596q-fmh7
  2. 9.9Prototype pollution in `GET /api/permission` (server permission controller `fetch`) leads to privilege escalation from app Builder to global Builder and…Fixed in 4.0.0GHSA-p7c8-m379-jf3x
  3. 9.9Broken Object-Level Authorization via attacker-controlled attachment key — cross-tenant file deletion (and conditional read) in the shared APPS object-store…Fixed in 4.0.0GHSA-wr7j-r9v4-6rjh
  4. 9.8Unverified-email OIDC/SSO account linking takes over password-less global Builder (isAccountLinkable allowlist omits builder)Fixed in 4.0.0GHSA-jm85-crv2-88px
  5. 9.1Unauthenticated automation execution at service privilege via User-Agent-conditional dev-workspace guard (POST /api/automations/:id/test)Fixed in 4.0.0GHSA-5rq2-4mjm-m7q2
Show 2 more
  1. CriticalAuthenticated RCE as root via unsandboxed require() of datasource plugin (incomplete fix of GHSA-gwr2-pgg3-p7xp)Fixed in 4.0.0GHSA-6wc7-w493-mw5m
  2. CriticalPublic API PUT /users/:userId lets any single-app Builder grant themselves an ADMIN role in any other workspace — incomplete fix of the role-assignment…Fixed in 4.0.0GHSA-q4f7-c337-92c9

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.