UpHeron
All vulnerabilities

Servers and applications

GHSA-8wqw-xg9x-89h8

Public API View Row Search Bypasses Per-View Authorization via Resource ID Parameter Mismatch

Severity
Medium 6.5
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
3.48.0
Weakness
Incorrect authorization (CWE-863)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Sources
Project advisories (GitHub)

Description

The public API v1 endpoint POST /api/public/v1/views/:viewId/rows/search bypasses per-view authorization checks. The view search route is registered under rowEndpoints which configures authorization for parameter tableId, but the route uses :viewId. Since tableId is absent from the route parameters, the resource ID extraction silently fails, and authorization falls back to a permissive base permission check. This allows any authenticated user with READ_ONLY role to read data from any view in the application, including views restricted to higher roles.

The public API route registration in packages/server/src/api/routes/public/index.ts applies authorization middleware for all row endpoints at line 145:

This calls paramSubResource("tableId", "rowId") which creates middleware that extracts ctx.params.tableId and ctx.params.rowId into ctx.resourceId and ctx.subResourceId respectively.

However, the view search route in packages/server/src/api/routes/public/rows.ts:199-205 uses :viewId:

From Budibase/budibase's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
BudibaseServers and applications · github:budibase/budibase
  • Every version before 3.48.0

References