CVE-2026-45718: Budibase authorization bypass in row action trigger

CVE-2026-45718 · Severity: medium · CVSS 5.4 · Published 2026-05-27

Budibase is a low-code platform that allows users to build applications with filtered views of database tables. A critical authorization flaw allows users with restricted access to a filtered view to execute automated actions on any row in the underlying table, including rows explicitly hidden by security filters. This bypasses the intended access control model and could expose sensitive data or allow unauthorized modifications to protected records.

Technologies: budibase (npm). Vendors: npm.

Quick answers

Is CVE-2026-45718 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45718 being exploited in the wild.
How severe is CVE-2026-45718?
Medium severity, with a CVSS score of 5.4, published 27 May 2026.
Which products and versions are affected?
budibase (npm) < 3.38.1, SEMVER:introduced=0,fixed=3.38.1.
Is there a fix for CVE-2026-45718?
Yes. budibase (npm): upgrade to 3.38.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45718 attacked?
It is attacked over the network.
Am I affected by CVE-2026-45718?
Check whether you run budibase (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • budibase (npm): upgrade to 3.38.1 or later
    npm install budibase@3.38.1

Technical details

The vulnerability is an authorization bypass (CWE-863) in the row action trigger endpoint at POST /api/tables/:sourceId/actions/:actionId/trigger. The middleware correctly validates that the user has READ permission on the filtered view and that row actions are enabled, but then discards the view context (sourceId) and passes only the underlying tableId to the controller. The controller and SDK then fetch and execute the action on the specified row using direct table-level lookups without re-validating against the view's query filters. This allows a BASIC-role user to trigger automations on any row, including those explicitly excluded by the view's security filters, potentially accessing sensitive field data or causing unauthorized data modifications. The attack requires view access and a valid row ID but no elevated privileges. A fix was released in version 3.38.1 that preserves the sourceId context and validates the target row against view filters before execution.

Affected products

  • Budibase budibase < 3.38.1

Identifiers

  • CVE-2026-45718
  • GHSA-3263-v5v9-xq8q

Timeline

  • 2026-05-12: disclosed
  • 2026-05-12: patched: Fixed in version 3.38.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.