Security: Budibase/budibase
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Arbitrary File Write via retrieveDirectory S3-Key Path TraversalGHSA-pxwc-66g3-5f27 published
Jul 22, 2026 by mjashanksCritical -
Unauthenticated SQL Injection via Webhook to EXECUTE_QUERY Automation ChainGHSA-x7h8-ww3q-xv7c published
Jul 22, 2026 by mjashanksHigh -
Cross-application resource injection via missing authorization on duplicate endpointGHSA-xqpq-288m-r5q7 published
Aug 14, 2026 by mjashanksHigh -
Privilege escalation via public role assignment API missing app-level authorizationGHSA-j9fc-w3mr-x6mv published
Jul 22, 2026 by mjashanksHigh -
Oracle datasource connector is still vulnerable to identifier SQL injection — incomplete fix of GHSA-qqf5-x7mj-v43pGHSA-xj29-x47g-9w2c published
Jul 22, 2026 by mjashanksHigh -
OIDC SSO account takeover: incoming identity linked by email without checking email_verifiedGHSA-hp6v-6jw7-gv2f published
Jul 22, 2026 by mjashanksCritical -
DNS rebinding SSRF bypasses remain in OpenAPI import and REST query executionGHSA-xg5g-26x8-cvf4 published
Jul 22, 2026 by mjashanksHigh -
Any authenticated user (incl. BASIC) can change the account-holder/admin emailGHSA-j82g-67x3-xcwh published
Jul 22, 2026 by mjashanksHigh -
PostgreSQL SET search_path SQL Injection in Database ConnectorGHSA-qqf5-x7mj-v43p published
Jun 18, 2026 by mjashanksHigh -
Datasource secrets stored in STRING typed fields (MongoDB connection string, Firebase private key) are returned unredacted by the datasource read APIGHSA-6mpp-gfg5-x2vv published
Jul 22, 2026 by mjashanksHigh