Executive brief
Budibase is a low-code platform used to build and deploy web applications. An authenticated user can access any other tenant's application metadata, source code, and internal configuration details through an unprotected API endpoint, potentially exposing navigation structure, user identifiers, and custom JavaScript code from competing organizations or victims. This could enable account takeover, business logic theft, or lateral movement into other systems.
Technical details
The GET /api/applications/:appId/appPackage endpoint is registered as a public route with no authorization middleware and performs no tenant validation, allowing any authenticated user to retrieve another tenant's full application document including navigation, role names, screens, JavaScript snippets, and user IDs by supplying a victim's app ID. The vulnerability stems from reliance on the caller-supplied app ID to resolve the workspace without verifying the requesting user's tenant membership. Patched in Budibase 3.45.0 with proper tenant and authorization checks added to the endpoint.
Affected products
- Budibase server before 3.45.0
Timeline
- 2026-09-26: advisory
- 2026-09-10: disclosed
- 2026-09-26: patched: patched in version 3.45.0