CVE-2026-82242

Budibase versions before 3.41.3 are missing an authorization check (CWE-862) on the POST /api/resources/duplicate endpoint, so an authenticated builder can duplicate resources into an application without holding any role in the destination workspace. The flaw is triggered by sending a duplication request with an arbitrary destination workspace ID in the request body, which causes tables, automations, queries, and screens to be injected into the victim application. Once resources are injected, the attacker can trigger the injected automations to run outgoing webhooks and exfiltrate data from applications they otherwise cannot access, yielding a high integrity impact (CVSS 4.0: 8.3 High). Any Budibase deployment running a version below 3.41.3 is affected where an attacker holds builder privileges, and there is no requirement for privileges in the targeted workspace. No public proof-of-concept or exploitation is currently known, and EPSS estimates a 0.3% probability of exploitation within 30 days.

What to do: Upgrade to Budibase 3.41.3 or later, which restores the missing authorization check on the POST /api/resources/duplicate endpoint. Until upgraded, restrict builder roles to trusted users and audit applications for unexpected tables, automations, queries, or screens, paying particular attention to injected automations with outgoing webhooks that could be used for data exfiltration.