Vulnerability Description
Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query requests with target table identifiers to bypass table-level access controls and manipulate restricted data.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Budibase/budibase/security/advisories/GHSA-vq3j-xwg3-pg8x
- https://www.vulncheck.com/advisories/budibase-before-3.41.3-authorization-bypass
- https://github.com/Budibase/budibase/security/advisories/GHSA-vq3j-xwg3-pg8x
FAQ
What is CVE-2026-82239?
CVE-2026-82239 is a vulnerability with a CVSS score of 8.1 (HIGH). Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table...
How severe is CVE-2026-82239?
CVE-2026-82239 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-82239?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.