# CVE-2026-45718: Budibase authorization bypass in row action trigger

Source: https://junglewise.ai/threats/cve-2026-45718-budibase-authorization-bypass-in-row-action-trigger  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-45718 · Severity: medium · CVSS 5.4 · Published 2026-05-27

Budibase is a low-code platform that allows users to build applications with filtered views of database tables. A critical authorization flaw allows users with restricted access to a filtered view to execute automated actions on any row in the underlying table, including rows explicitly hidden by security filters. This bypasses the intended access control model and could expose sensitive data or allow unauthorized modifications to protected records.

Technologies: [budibase (npm)](https://junglewise.ai/threats/technologies/budibase). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-45718 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45718 being exploited in the wild.

**How severe is CVE-2026-45718?** Medium severity, with a CVSS score of 5.4, published 27 May 2026.

**Which products and versions are affected?** budibase (npm) < 3.38.1, SEMVER:introduced=0,fixed=3.38.1.

**Is there a fix for CVE-2026-45718?** Yes. budibase (npm): upgrade to 3.38.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45718 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-45718?** Check whether you run budibase (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- budibase (npm): upgrade to 3.38.1 or later

  ```sh
  npm install budibase@3.38.1
  ```


## Technical details

The vulnerability is an authorization bypass (CWE-863) in the row action trigger endpoint at POST /api/tables/:sourceId/actions/:actionId/trigger. The middleware correctly validates that the user has READ permission on the filtered view and that row actions are enabled, but then discards the view context (sourceId) and passes only the underlying tableId to the controller. The controller and SDK then fetch and execute the action on the specified row using direct table-level lookups without re-validating against the view's query filters. This allows a BASIC-role user to trigger automations on any row, including those explicitly excluded by the view's security filters, potentially accessing sensitive field data or causing unauthorized data modifications. The attack requires view access and a valid row ID but no elevated privileges. A fix was released in version 3.38.1 that preserves the sourceId context and validates the target row against view filters before execution.

## Affected products

- Budibase budibase < 3.38.1

## Identifiers

- CVE-2026-45718
- GHSA-3263-v5v9-xq8q

## Timeline

- 2026-05-12: disclosed
- 2026-05-12: patched: Fixed in version 3.38.1

## References

- [https://github.com/Budibase/budibase/security/advisories/GHSA-3263-v5v9-xq8q](https://github.com/Budibase/budibase/security/advisories/GHSA-3263-v5v9-xq8q)
- [https://github.com/Budibase/budibase](https://github.com/Budibase/budibase)
- [https://github.com/Budibase/budibase/releases/tag/3.38.1](https://github.com/Budibase/budibase/releases/tag/3.38.1)

## Related threats

- [Budibase database connector SQL injection in PostgreSQL, MS SQL, and MySQL](https://junglewise.ai/threats/cve-2026-64657-budibase-database-connector-sql-injection-in-postgresql-ms-sql)
- [Budibase SSRF in executeQuery automation step](https://junglewise.ai/threats/cve-2026-48128-budibase-ssrf-in-executequery-automation-step)
- [Budibase unrestricted file upload leading to stored XSS](https://junglewise.ai/threats/cve-2026-46426-budibase-unrestricted-file-upload-leading-to-stored-xss)
- [Budibase SSRF via URL validation bypass in Plugin upload](https://junglewise.ai/threats/cve-2026-45061-budibase-ssrf-via-url-validation-bypass-in-plugin-upload)
- [Budibase unrestricted SSRF in REST datasource query preview](https://junglewise.ai/threats/cve-2026-33226-budibase-unrestricted-ssrf-in-rest-datasource-query-preview)