CVE-2026-82239CWE-862broken-access-control

CVE-2026-82239

High · published August 28, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
26.9
In the wild
Unconfirmed
What it is

Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query requests with target table identifiers to bypass table-level access controls and manipulate restricted data.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00346 · 26.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-28T16:16Z
References (3)
https://github.com/Budibase/budibase/security/advisories/GHSA-vq3j-xwg3-pg8x · [email protected]https://www.vulncheck.com/advisories/budibase-before-3.41.3-authorization-bypass-via-datasources-query · [email protected]https://github.com/Budibase/budibase/security/advisories/GHSA-vq3j-xwg3-pg8x · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 10:49Z
    Budibase before 3.41.3 Authorization Bypass via datasources/query
    cvelistv5