CVE-2026-82239
Deferred Deferred - Pending Action

Budibase Unauthorized Data Access via Query Endpoint

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description
Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query requests with target table identifiers to bypass table-level access controls and manipulate restricted data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-82239
EUVD
EUVD-2026-67691

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
budibase budibase to 3.41.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Budibase before version 3.41.3 has a flaw where BASIC users can bypass table-level permissions. The POST /api/datasources/query endpoint does not enforce role restrictions, allowing attackers to read, create, update, or delete rows in any table regardless of configured access controls.

Detection Guidance

To detect this vulnerability, check if your Budibase instance is running a version prior to 3.41.3. Verify if the POST /api/datasources/query endpoint is accessible by users with BASIC role and if they can manipulate data across tables. Monitor logs for unauthorized query requests targeting restricted tables.

Impact Analysis

If you use Budibase with BASIC role users, attackers could exploit this to access or modify sensitive data they shouldn't be able to. This could lead to data breaches, unauthorized changes, or loss of data integrity.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by allowing unauthorized access to personal or health data. It undermines data protection controls and may lead to regulatory penalties or loss of trust.

Mitigation Strategies

Upgrade Budibase to version 3.41.3 or later to enforce proper role restrictions. Review and restrict BASIC role permissions to prevent unauthorized access to sensitive data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82239. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart