Executive brief
Budibase is a low-code platform that connects to external databases and APIs through datasources. An authorization flaw allows any authenticated user with the BASIC role (the lowest non-public role assigned to all app users) to modify datasource connection settings, including the server host, port, and credentials. An attacker can redirect a datasource to internal IP addresses to probe private networks, exfiltrate metadata from cloud services, or break all application queries for legitimate users by injecting invalid configurations.
Technical details
The vulnerability is an RBAC bypass in datasource management. The PUT /api/datasources/:datasourceId route is registered under authorizedRoutes with TABLE/READ permission check, the same level as the read-only GET endpoint. However, destructive operations (create, delete, verify) correctly use builderRoutes. The authorization middleware allows any BASIC-role user (who carries TABLE/WRITE implicitly) to pass the check, and the datasource controller performs no additional builder-level authorization guard. The mergeConfigs function does not restrict non-password fields (host, port, database, url, ssl), allowing attackers to supply arbitrary connection parameters. Attack vectors include: (1) SSRF via SQL driver redirection to cloud metadata endpoints or internal services at arbitrary ports; (2) SSRF via REST datasource URL rewriting; (3) denial of service by corrupting datasource config. Patch is available in version 3.38.1.
Affected products
- Budibase @budibase/server <3.38.1
Timeline
- 2026-05-15: disclosed: GHSA-44m2-crh7-f4q2 published
- 2026-05-12: patched: Version 3.38.1 released with fix