Skip to content
CVE PROGRAM SOURCE RECORD8.3 High

CVE-2026-82242

Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. Attackers can inject resources by specifying an arbitrary destination workspace ID in the request body, then trigger injected automations with outgoing webhooks to exfiltrate data from victim applications.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

budibase server

Default version status: unaffected

  • 0 to < 3.41.3affected
  • 3.41.3unaffected
pkg:npm/%40budibase/server

References