VYPR
Vypr IntelligenceAI-generatedSep 26, 2026· 9 CVEs

Budibase: Nine Vulnerabilities Including Auth Bypass and File Write Disclosed Together

Nine vulnerabilities, including high-severity flaws enabling unauthorized access and data exfiltration, were disclosed for Budibase and patched in version 3.45.0.

Key findings

  • Nine vulnerabilities disclosed in Budibase on September 26, 2026, patched in version 3.45.0.
  • High severity flaws include authentication bypass, arbitrary file write/read, and cross-workspace access.
  • Medium severity issues involve cross-tenant data disclosure and credential exposure.
  • Vulnerabilities affect API endpoints, authentication mechanisms, and data handling processes.
  • Users must update to Budibase 3.45.0 to address these critical security risks.

On September 26, 2026, a batch of nine vulnerabilities was disclosed for Budibase, a low-code platform for building internal tools. The vulnerabilities, all patched in version 3.45.0, range in severity from Medium to High, with several allowing for significant data exposure, unauthorized access, and arbitrary file writes. This coordinated disclosure highlights critical security weaknesses across multiple components of the Budibase server.

Several vulnerabilities center on unauthorized data access and information disclosure. CVE-2026-100688, a Medium severity flaw, permits authenticated users to access another tenant's application metadata and source code via the GET /api/applications/:appId/appPackage endpoint. Similarly, CVE-2026-100685 (High, CVSSv3 7.7) allows builders with access to a single workspace to enumerate chat identity link records across all workspaces in a tenant through the GET /api/chat-links endpoint. Another Medium severity issue, CVE-2026-100687, involves the failure to redact datasource credentials before broadcasting external table updates, potentially exposing database passwords and API keys to attackers with Builder access.

Authentication and authorization bypasses are also prominent themes. CVE-2026-100684, a High severity vulnerability (CVSSv3 8.1), exploits an authentication bypass in the OIDC/SSO login path, allowing attackers to potentially gain unauthorized access by manipulating pending user invites. CVE-2026-100686, also High severity (CVSSv3 8.1), permits builders to assign application roles across workspace boundaries due to insufficient per-app authorization validation in the POST /api/global/groups/:groupId/apps endpoint.

Further critical flaws include arbitrary file write and read capabilities. CVE-2026-100682 (High, CVSSv3 8.8) is an arbitrary file write vulnerability in the PWA icon upload endpoint, where improper symlink validation allows attackers with BUILDER roles to write arbitrary files. CVE-2026-100680 (High, CVSSv3 8.1) enables authenticated builders to read arbitrary local files by exploiting the external JSON reference resolution in the OpenAPI/Swagger import validator. Additionally, CVE-2026-100683, a High severity flaw (CVSSv3 8.0), involves insecure handling of MySQL and MSSQL column-rename DDL, interpolating identifiers directly into raw query strings without proper sanitization. Lastly, CVE-2026-100681 (Medium, CVSSv3 5.4) presents an unauthenticated server-side request forgery and credential exfiltration risk through a vulnerable Microsoft Teams webhook endpoint.

All nine vulnerabilities were addressed in Budibase version 3.45.0. Users are strongly advised to update to this version to mitigate the risks associated with these diverse security weaknesses, which collectively expose sensitive data, allow unauthorized access, and enable arbitrary file manipulation. The breadth of these issues underscores the importance of regular security patching for all Budibase deployments.

The patched version for all these vulnerabilities is 3.45.0.

The vulnerabilities disclosed are:

AI-written article. Grounded in 9 CVE records listed below.