Is CVE-2026-100688 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100688 being exploited in the wild.

How severe is CVE-2026-100688?

Medium severity, with a CVSS score of 6.5, published 26 September 2026.

Is there a fix for CVE-2026-100688?

A patch was published on 2026-09-26: patched in version 3.45.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100688 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100688?

Check whether you run Budibase Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100688: Budibase server cross-tenant information disclosure in appPackage endpoint

CVE-2026-100688 · Severity: medium · CVSS 6.5 · Published 2026-09-26

Budibase is a low-code platform used to build and deploy web applications. An authenticated user can access any other tenant's application metadata, source code, and internal configuration details through an unprotected API endpoint, potentially exposing navigation structure, user identifiers, and custom JavaScript code from competing organizations or victims. This could enable account takeover, business logic theft, or lateral movement into other systems.

Technologies: Budibase Server. Vendors: Budibase.

Quick answers

Is CVE-2026-100688 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100688 being exploited in the wild.
How severe is CVE-2026-100688?: Medium severity, with a CVSS score of 6.5, published 26 September 2026.
Which products and versions are affected?: Budibase Server before 3.45.0.
Is there a fix for CVE-2026-100688?: A patch was published on 2026-09-26: patched in version 3.45.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100688 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100688?: Check whether you run Budibase Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The GET /api/applications/:appId/appPackage endpoint is registered as a public route with no authorization middleware and performs no tenant validation, allowing any authenticated user to retrieve another tenant's full application document including navigation, role names, screens, JavaScript snippets, and user IDs by supplying a victim's app ID. The vulnerability stems from reliance on the caller-supplied app ID to resolve the workspace without verifying the requesting user's tenant membership. Patched in Budibase 3.45.0 with proper tenant and authorization checks added to the endpoint.

Affected products

Budibase server before 3.45.0

Timeline

2026-09-26: advisory
2026-09-10: disclosed
2026-09-26: patched: patched in version 3.45.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.