All products
@budibase/server
npm · Package42 reports| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|
| Budibase: Unvalidated VectorDB Host Parameter Enables SSRFCVE-2026-48148 · GHSA-CV96-5348-P5P8 |
@budibase/server |
npm |
Medium
|
Fix reported |
|
| Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist ValidationCVE-2026-45548 · GHSA-RPJ4-7X2V-WJRF |
@budibase/server |
npm |
High
|
Fix reported |
|
| Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API CVE-2026-45719 · GHSA-363W-HVWH-W7M6 |
@budibase/server |
npm |
Medium
|
Fix reported |
|
| Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URLCVE-2026-45717 · GHSA-44M2-CRH7-F4Q2 |
@budibase/server |
npm |
High
|
Fix reported |
|
| Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URLCVE-2026-48152 · GHSA-3GP5-Q4JW-3V94 |
@budibase/server |
npm |
High
|
Fix reported |
|
| Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schemaCVE-2026-48151 · GHSA-QHV3-WJG8-6FX6 |
@budibase/server |
npm |
High
|
Fix reported |
|
| Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist ProtectionCVE-2026-48146 · GHSA-G6QX-G4PR-92V7 |
@budibase/server |
npm |
High
|
Fix reported |
|
| Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadataCVE-2026-48153 · GHSA-4Q6H-8P4V-67VQ |
@budibase/server |
npm |
High
|
Fix reported |
|
| Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assignCVE-2026-48150 · GHSA-6XP4-CF37-PPJH |
@budibase/server |
npm |
Critical
|
Fix reported |
|
| Budibase: SSRF Bypass via HTTP Redirect in REST Datasource IntegrationCVE-2026-45715 · GHSA-FGQV-JH4G-PVG2 |
@budibase/server |
npm |
High
|
Fix reported |
|
| Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`CVE-2026-54356 · GHSA-6X9P-4R67-5GJX |
@budibase/server |
npm |
High
|
No fix reported |
|
| Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappingsCVE-2026-73301 · GHSA-4QCJ-M5WP-JMF4 |
@budibase/server |
npm |
Medium
|
No fix reported |
|
| Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role UsersCVE-2026-73304 · GHSA-FCRW-F7GG-6G9F |
@budibase/server |
npm |
Medium
|
Fix reported |
|
| Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLsCVE-2026-72859 · GHSA-XCX6-4F2G-HHGX |
@budibase/server |
npm |
High
|
No fix reported |
|
| Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP BlacklistCVE-2026-35219 · GHSA-5FPJ-28RV-84R7 |
@budibase/server |
npm |
High
|
Fix reported |
|
| Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query executionCVE-2026-72855 · GHSA-XG5G-26X8-CVF4 |
@budibase/server |
npm |
High
|
No fix reported |
|
| Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/deleteCVE-2026-73617 · GHSA-PMPG-2MXQ-6XWR |
@budibase/server |
npm |
High
|
No fix reported |
|
| Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)CVE-2026-72849 · GHSA-PVCR-8MVP-W8QR |
@budibase/server |
npm |
High
|
No fix reported |
|
| Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query ExecutionCVE-2026-73618 · GHSA-QW6M-8FW2-2V64 |
@budibase/server |
npm |
High
|
No fix reported |
|
| Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database ConnectorCVE-2026-73408 · GHSA-2XGG-R2WC-C5R2 |
@budibase/server |
npm |
High
|
No fix reported |
|
