Budibase Server vulnerabilities

• budibase server Budibase server before 3.45.0 Cross-Tenant Information Disclosure CVE-2026-100688 7.1 HighSeptember 26, 2026
• budibase server Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast CVE-2026-100687 7.0 HighSeptember 26, 2026
• budibase server Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps CVE-2026-100686 8.6 HighSeptember 26, 2026
• budibase server Budibase before 3.45.0 Information Disclosure via Chat Links CVE-2026-100685 8.3 HighSeptember 26, 2026
• budibase server Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC CVE-2026-100684 9.2 CriticalSeptember 26, 2026
• budibase server Budibase before 3.45.0 SQL Injection via column-rename DDL CVE-2026-100683 8.9 HighSeptember 26, 2026
• budibase server Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink CVE-2026-100682 8.7 HighSeptember 26, 2026
• budibase server Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook CVE-2026-100681 6.3 MediumSeptember 26, 2026
• budibase server Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import CVE-2026-100680 8.6 HighSeptember 26, 2026
• budibase server Budibase Server before 3.41.3 SSRF via Query Import CVE-2026-82246 7.1 HighAugust 28, 2026
• budibase server Budibase before 3.41.3 Missing Authorization License Management CVE-2026-82245 7.2 HighAugust 28, 2026
• budibase server Budibase before 3.41.3 Remote Code Execution via Plugin eval() CVE-2026-82244 9.4 CriticalAugust 28, 2026
• budibase server Budibase Server before 3.41.3 SSRF with Credential Leakage CVE-2026-82243 8.3 HighAugust 28, 2026
• budibase server Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization CVE-2026-82242 8.3 HighAugust 28, 2026
• budibase server Budibase backend-core SSRF via incomplete default blacklist CVE-2026-82241 7.1 HighAugust 28, 2026
• budibase server Budibase before 3.41.3 Privilege Escalation via User Update API CVE-2026-82240 8.6 HighAugust 28, 2026
• budibase server Budibase before 3.41.3 Authorization Bypass via datasources/query CVE-2026-82239 8.6 HighAugust 28, 2026
• budibase server Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook CVE-2026-72851 9.0 CriticalAugust 13, 2026
• budibase server Budibase before 3.40.0 Arbitrary File Write via Path Traversal CVE-2026-72850 9.4 CriticalAugust 13, 2026
• budibase server Budibase before 3.40.0 NoSQL Injection via MongoDB datasource CVE-2026-73617 7.1 HighJuly 24, 2026
• budibase server Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF CVE-2026-72849 8.7 HighJuly 24, 2026
• budibase server Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter CVE-2026-73618 8.7 HighJuly 24, 2026
• budibase server Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST CVE-2026-72855 8.4 HighJuly 24, 2026
• budibase server Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL CVE-2026-72859 8.3 HighJuly 24, 2026