CyberRota Analysis
AI-GeneratedBudibase versions prior to 3.41.3 are vulnerable due to inadequate enforcement of per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to access and manipulate data across all tables. This flaw enables unauthorized reading, creation, updating, or deletion of rows, posing a significant risk to data integrity and confidentiality. Organizations using Budibase should prioritize patching to mitigate potential exploitation by malicious actors leveraging this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query requests with target table identifiers to bypass table-level access controls and manipulate restricted data.