Repository navigation
Security: Budibase/budibase
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Arbitrary local file read via external `$ref` resolution in OpenAPI/Swagger datasource import (POST /api/queries/import/info)GHSA-8xr5-pggf-26jq published
Sep 10, 2026 by mjashanksCritical -
Unauthenticated SSRF and OAuth credential exfiltration via forged Microsoft Teams webhook activity (`serviceUrl` injection)GHSA-942w-fccr-8r3c published
Sep 10, 2026 by mjashanksCritical -
Budibase arbitrary file write as root via ZIP symlink traversalGHSA-37r6-5jxh-vm83 published
Sep 10, 2026 by mjashanksCritical -
Second-order SQL identifier injection in MySQL/MSSQL column-rename DDL (sqlTable.ts) bypassing quote helpersGHSA-ppj8-hmx2-m546 published
Sep 10, 2026 by mjashanksHigh -
Unverified-email OIDC/SSO invite reconcile claims pending invite (up to admin.global) by email alone, no codeGHSA-35ch-57g2-3g98 published
Sep 10, 2026 by mjashanksCritical -
Budibase: Cross-workspace Chat Identity Link disclosure via unscoped GET /api/chat-linksGHSA-76m3-47v8-p7h6 published
Sep 10, 2026 by mjashanksHigh -
Cross-workspace privilege escalation via POST /api/global/groups/:groupId/apps (missing per-app authorization)GHSA-pp5r-q4fp-mcj3 published
Sep 10, 2026 by mjashanksHigh -
External table save/delete broadcasts unredacted datasource (plaintext credentials) to the Builder collaboration websocket roomGHSA-rmv5-3xpj-w885 published
Sep 10, 2026 by mjashanksModerate -
Cross-tenant application disclosure — any authenticated user can read another tenant's app metadata and source snippets via `GET /api/applications/:appId/appPackage`GHSA-4946-qf2m-wrh5 published
Sep 10, 2026 by mjashanksHigh -
Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)GHSA-c8vc-7pv3-g98p published
Jul 22, 2026 by mjashanksHigh