CVE-2026-73617
Received Received - Intake

NoSQL Injection in Budibase Prior to 3.40.0

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass per-user access controls, read arbitrary documents, execute JavaScript via $where operators, or modify collections through update and delete operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73617
EUVD
EUVD-2026-57821

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
budibase budibase to 3.40.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73617 is a NoSQL injection vulnerability in Budibase versions before 3.40.0 affecting the MongoDB datasource integration. User-supplied parameters are processed with Handlebars using noEscaping: true and parsed without operator filtering, allowing attackers to inject MongoDB operators like $ne or $where into queries. This bypasses access controls, enabling unauthorized data reads, JavaScript execution, or data modifications.

Detection Guidance

To detect this vulnerability, inspect Budibase MongoDB datasource queries for user-controlled parameters processed with Handlebars noEscaping: true. Check for injected MongoDB operators like $ne, $where, or $comment in query logs or application inputs. Monitor for unauthorized data access patterns or unusual JavaScript execution traces in MongoDB logs.

Impact Analysis

Attackers with basic app access can bypass access controls to read all documents the MongoDB connection can access, execute arbitrary server-side JavaScript via $where operators, perform cross-collection joins, or update/delete data. The impact depends on the MongoDB datasource permissions, potentially exposing sensitive data or allowing full data manipulation.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade Budibase to version 3.40.0 or later immediately. If upgrading is not possible, disable the MongoDB datasource integration or restrict BASIC app user permissions to prevent query parameter manipulation. Implement input validation to strip MongoDB operators from user inputs before query processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73617. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart