CVE-2026-82242CWE-862broken-access-control

CVE-2026-82242

High · published August 28, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
28.5
In the wild
Unconfirmed
What it is

Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. Attackers can inject resources by specifying an arbitrary destination workspace ID in the request body, then trigger injected automations with outgoing webhooks to exfiltrate data from victim applications.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
8.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
EPSS
0.00359 · 28.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-28T16:16Z
References (3)
https://github.com/Budibase/budibase/security/advisories/GHSA-xqpq-288m-r5q7 · [email protected]https://www.vulncheck.com/advisories/budibase-before-3.41.3-cross-application-resource-injection-via-missing-authorization · [email protected]https://github.com/Budibase/budibase/security/advisories/GHSA-xqpq-288m-r5q7 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 10:49Z
    Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization
    cvelistv5