CyberRota Analysis
AI-GeneratedBudibase versions prior to 3.41.3 are vulnerable due to a missing authorization flaw in the POST /api/resources/duplicate endpoint, allowing authenticated users to inject resources into any application without proper permissions. This could lead to unauthorized data exfiltration through triggered automations and webhooks. Organizations using affected versions should prioritize patching to mitigate the risk of resource injection and potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. Attackers can inject resources by specifying an arbitrary destination workspace ID in the request body, then trigger injected automations with outgoing webhooks to exfiltrate data from victim applications.