CVE-2026-73618
Received Received - Intake

NoSQL Injection in Budibase Server

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON structural characters to alter MongoDB queries, bypassing filters to read, modify, or delete arbitrary documents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73618
EUVD
EUVD-2026-57822

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
budibase server to 3.40.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73618 is a NoSQL injection vulnerability in Budibase Server before version 3.40.0. It occurs in the MongoDB query execution endpoint where user-supplied parameters are inserted into JSON query templates without proper sanitization of JSON metacharacters like quotes or operators. Attackers with query write permission can inject these characters to alter the structure of MongoDB queries, bypassing intended filters and accessing, modifying, or deleting arbitrary documents.

Detection Guidance

To detect this vulnerability, check if your Budibase Server version is below 3.40.0. Inspect network traffic for POST requests to /api/v2/queries/:queryId with JSON payloads containing user-supplied parameters. Look for unusual query structures or injected JSON metacharacters like quotes or operators (e.g., $ne).

Commands to check version: curl -s http://<server>/api/version or check package.json in Budibase installation directory. Monitor logs for suspicious query executions or unauthorized data access attempts.

Impact Analysis

This vulnerability allows attackers to read sensitive data, modify or delete documents in the database, and bypass authorization controls. Exploitation requires only standard query write permissions, which regular users may have. Attackers could exfiltrate data, alter records, or delete bulk data, leading to data loss or integrity issues.

Compliance Impact

This vulnerability could lead to unauthorized access, modification, or deletion of sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance may result in legal penalties, reputational damage, and loss of trust due to data breaches or integrity failures.

Mitigation Strategies

Immediately upgrade Budibase Server to version 3.40.0 or later. If upgrading is not possible, restrict QUERY WRITE permissions to only trusted users. Implement input validation to sanitize JSON metacharacters in query parameters before processing.

Add Joi schema validation to the /api/v2/queries/:queryId endpoint to constrain parameter shapes. Disable Handlebars interpolation with noEscaping: true and switch to parameterized query approaches to prevent structural query modification.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73618. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart