CVE-2026-82239

Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint (CWE-862, missing authorization), so table-level permissions are not applied to requests sent through it. An authenticated user holding the low-privilege BASIC role can trigger the flaw by submitting crafted query requests that include target table identifiers for any table in the deployment. This bypass yields read, create, update, and delete access to rows in any table regardless of configured permissions, giving high confidentiality and integrity impact (CVSS 4.0 score 8.6) without requiring user interaction. Any Budibase deployment running a version before 3.41.3 that has BASIC-role accounts is affected. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade to Budibase 3.41.3 or later. Until then, minimize or monitor BASIC-role accounts and review audit logs for unexpected POST /api/datasources/query activity touching tables those users should not access; a reverse-proxy rule restricting or validating requests to that endpoint is a partial mitigation.