Security: Budibase/budibase
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentialsGHSA-jj36-r9w3-3pfh published
May 28, 2026 by mjashanksHigh -
Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in BudibaseGHSA-v7j5-vc4m-723w published
May 28, 2026 by mjashanksHigh -
Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URLGHSA-3gp5-q4jw-3v94 published
May 21, 2026 by mjashanksHigh -
Stored XSS in Text component: BASIC users execute JS in admin session via MarkdownViewer innerHTML + CDN+srcdoc CSP bypassGHSA-57p7-9h9w-xqpw published
May 21, 2026 by mjashanksHigh -
SCIM endpoints lack role-based authorization, BASIC users CRUD tenant usersGHSA-q9rw-q89f-jx2f published
May 14, 2026 by mjashanksCritical -
NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/deleteGHSA-pmpg-2mxq-6xwr published
Jul 22, 2026 by mjashanksHigh -
Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assignGHSA-6xp4-cf37-ppjh published
May 21, 2026 by mjashanksCritical -
Snowflake private key returned unmasked from datasource API to BASIC usersGHSA-qv26-4hvj-m7fv published
May 14, 2026 by mjashanksHigh -
SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadataGHSA-4q6h-8p4v-67vq published
May 21, 2026 by mjashanksHigh