@budibase/server vulnerabilities (npm)
42 vulnerabilities.
-
@budibase/servernpm Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url` 7.1 High -
@budibase/servernpm Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist 7.1 High -
@budibase/servernpm Budibase: SSRF via bare fetch() in uploadUrl during AI table generation 4.9 Medium -
@budibase/servernpm Budibase: SSRF via DNS rebinding in the REST datasource integration 8.5 High -
@budibase/servernpm Budibase before 3.40.0 NoSQL Injection via MongoDB datasource 7.1 High -
@budibase/servernpm Budibase: Account Enumeration via Login Lockout Response Differential 5.3 Medium -
@budibase/servernpm Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF 8.7 High -
@budibase/servernpm Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector 7.6 High -
@budibase/servernpm Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter 8.7 High -
@budibase/servernpm Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders 5.7 Medium -
@budibase/servernpm Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint 7.5 High -
@budibase/servernpm Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152)) 9.0 Critical -
@budibase/servernpm Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified 9.0 Critical -
@budibase/servernpm Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST 8.4 High -
@budibase/servernpm Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL 8.3 High -
@budibase/servernpm Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile 5.1 Medium -
@budibase/servernpm Budibase: SQL Injection via `multipleStatements: true` 9.6 Critical -
@budibase/servernpm Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session) 8.2 High -
@budibase/servernpm Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users 4.9 Medium -
@budibase/servernpm Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings 4.3 Medium -
@budibase/servernpm Budibase: Privilege escalation via public role assignment API missing app-level authorization 8.8 High -
@budibase/servernpm Budibase: Anonymous NoSQL operator injection via published-app query templates 10.0 Critical -
@budibase/servernpm Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload 9.6 Critical -
@budibase/servernpm Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override 8.2 High -
@budibase/servernpm Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials 8.2 High -
@budibase/servernpm Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials 7.4 High -
@budibase/servernpm Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase 7.3 High -
@budibase/servernpm Budibase: Unvalidated VectorDB Host Parameter Enables SSRF 5.3 Medium -
@budibase/servernpm Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection 7.7 High -
@budibase/servernpm Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign 9.0 Critical -
@budibase/servernpm Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema 7.5 High -
@budibase/servernpm Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL 8.1 High -
@budibase/servernpm Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata 8.5 High -
@budibase/servernpm Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API 6.5 Medium -
@budibase/servernpm Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters… 8.8 High -
@budibase/servernpm Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration 7.7 High -
@budibase/servernpm Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation 7.7 High -
@budibase/servernpm Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step 9.1 Critical -
@budibase/servernpm Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write 8.7 High -
@budibase/servernpm Budibase: Command Injection in Bash Automation Step 8.7 High -
@budibase/servernpm Budibase has a Command Injection in PostgreSQL Dump Command 8.6 High -
@budibase/servernpm Budibase affected by VM2 Constructor Escape Vulnerability 9.8 Critical