CVE-2026-82239: Budibase before 3.41.3 Authorization Bypass via datasources/query
Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query requests with target table identifiers to bypass table-level access controls and manipulate restricted data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.41.3 - Compensating control
Temporarily restrict access to the POST /api/datasources/query endpoint (e.g., via network/API gateway controls) to prevent BASIC-role users from exploiting the authorization bypass until the platform is upgraded to 3.41.3.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Authenticated users with the BASIC role can exploit it. They do not need elevated table permissions, because the affected endpoint fails to enforce per-table role restrictions.
What access does an attacker need to manipulate restricted data?
The attacker needs a BASIC-role account and the ability to send crafted POST requests to /api/datasources/query containing target table identifiers. No user interaction is required.
What data operations are possible through the bypass?
An affected BASIC user can read, create, update, or delete rows in any table, including tables for which that user has no configured permission.
Which versions need remediation?
Budibase versions before 3.41.3 are affected. Upgrade to 3.41.3 or later to address the described authorization bypass.