CVE-2026-100688: Budibase server before 3.45.0 Cross-Tenant Information Disclosure
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrieve sensitive application details including navigation structure, role names, internal screen URLs, JavaScript snippets, and user identifiers without authorization checks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Budibase Server user can exploit it if they can supply the app ID of an application belonging to another tenant. No user interaction is required.
What information may be exposed?
The affected endpoint can disclose another tenant's application metadata and source code, including navigation structure, role names, internal screen URLs, JavaScript snippets, and user identifiers.
Which deployments are affected?
Budibase Server versions before 3.45.0 are affected. The issue is in the GET /api/applications/:appId/appPackage endpoint and results from missing authorization checks across tenants.
How can an organization check for exposure?
Review access and request logs for GET requests to /api/applications/:appId/appPackage, especially where authenticated users request application IDs not associated with their own tenant. Treat successful cross-tenant responses as evidence of exposure.