CVE-2026-82242: Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization
Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. Attackers can inject resources by specifying an arbitrary destination workspace ID in the request body, then trigger injected automations with outgoing webhooks to exfiltrate data from victim applications.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.41.3 - Compensating control
Restrict authenticated access to the POST /api/resources/duplicate endpoint so only users with the appropriate role in the destination workspace can duplicate resources into that workspace.
Event History
Frequently Asked Questions
Which Budibase deployments are affected?
Budibase versions before 3.41.3 are affected.
What access does an attacker need?
The attacker must be authenticated as a builder. They do not need any role in the destination workspace.
How can the injected resources be used to access victim application data?
An attacker can trigger injected automations that use outgoing webhooks to exfiltrate data from victim applications.