Executive brief
Budibase is a low-code platform that allows users to build applications with filtered views of database tables. A critical authorization flaw allows users with restricted access to a filtered view to execute automated actions on any row in the underlying table, including rows explicitly hidden by security filters. This bypasses the intended access control model and could expose sensitive data or allow unauthorized modifications to protected records.
Technical details
The vulnerability is an authorization bypass (CWE-863) in the row action trigger endpoint at POST /api/tables/:sourceId/actions/:actionId/trigger. The middleware correctly validates that the user has READ permission on the filtered view and that row actions are enabled, but then discards the view context (sourceId) and passes only the underlying tableId to the controller. The controller and SDK then fetch and execute the action on the specified row using direct table-level lookups without re-validating against the view's query filters. This allows a BASIC-role user to trigger automations on any row, including those explicitly excluded by the view's security filters, potentially accessing sensitive field data or causing unauthorized data modifications. The attack requires view access and a valid row ID but no elevated privileges. A fix was released in version 3.38.1 that preserves the sourceId context and validates the target row against view filters before execution.
Affected products
- Budibase budibase < 3.38.1
Timeline
- 2026-05-12: disclosed
- 2026-05-12: patched: Fixed in version 3.38.1