CVE-2026-82242
Deferred Deferred - Pending Action

Budibase Missing Authorization in Resource Duplication

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description
Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. Attackers can inject resources by specifying an arbitrary destination workspace ID in the request body, then trigger injected automations with outgoing webhooks to exfiltrate data from victim applications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-82242
EUVD
EUVD-2026-67694

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
budibase budibase to 3.41.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows authenticated users with builder privileges in Budibase versions before 3.41.3 to inject malicious resources like tables, automations, queries, and screens into any application within a different workspace by specifying an arbitrary destination workspace ID. The injected automations can then be triggered via outgoing webhooks to steal data from victim applications.

Detection Guidance

Monitor for unauthorized POST requests to /api/resources/duplicate with arbitrary workspace IDs in the request body. Check for unexpected table, automation, query, or screen injections in applications. Review logs for outgoing webhook triggers from unknown sources.

Impact Analysis

If you use Budibase versions before 3.41.3, an attacker with builder access could inject malicious resources into your applications. This could lead to unauthorized data exfiltration, application compromise, or further attacks within your environment.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Upgrade Budibase to version 3.41.3 or later. Restrict access to the /api/resources/duplicate endpoint. Implement strict role-based access controls for workspace modifications. Monitor for suspicious activity in application resources and webhook triggers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82242. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart