Executive brief
Budibase is a low-code platform used to build internal business applications. A security flaw in the Budibase Worker component allows an attacker to bypass Cross-Site Request Forgery (CSRF) protections. By tricking a logged-in administrator into clicking a malicious link, an attacker could perform unauthorized actions such as inviting new admin users, changing global security settings, or modifying user roles, potentially leading to a full takeover of the Budibase instance.
Technical details
The vulnerability exists in the `buildMatcherRegex` and `matches` functions within `packages/backend-core/src/middleware/matchers.ts`. Route patterns used to identify public (non-CSRF protected) endpoints are compiled into regular expressions without start (^) or end ($) anchors. Furthermore, these regexes are tested against the full request URL including the query string. An attacker can bypass CSRF, tenancy, and authentication middleware by appending a known public route pattern (e.g., `/api/global/auth/`) as a query parameter to a request targeting a protected endpoint. This allows for cross-origin state-changing operations like user management and configuration updates. The issue was addressed in version 3.35.4.
Affected products
- Budibase Budibase < 3.35.4
Timeline
- 2026-05-21: disclosed
- 2026-06-12: advisory: Updated advisory published