Executive brief
Budibase is a low-code platform for building business applications and automations. A vulnerability allows Basic app users—who should only have limited access to published app functionality—to extract sensitive REST API credentials (bearer tokens, API keys, OAuth secrets) that were configured by administrators. An attacker can modify the datasource URL and intercept server-side API calls, capturing authentication headers intended only for legitimate API endpoints.
Technical details
The vulnerability exists in Budibase's REST datasource handling. GET and PUT routes for individual datasources (/api/datasources/:datasourceId) are guarded only by generic TABLE READ permission, not builder/admin-specific checks. Basic app users have the WRITE permission set, which includes TABLE READ. When a Basic user fetches a datasource, secrets are redacted to placeholders (PASSWORD_REPLACEMENT). However, the update endpoint merges user-supplied config with stored secrets: when it encounters redaction placeholders, mergeConfigs() restores the original stored secrets. An attacker can then modify config.url to point to an attacker-controlled listener, execute a saved relative-path REST query, and Budibase will prefix the attacker URL and apply the restored auth headers server-side, disclosing the credential to the attacker. No authentication bypass is required beyond normal Basic user access. The vulnerability affects Budibase versions prior to 3.39.0; patch status and availability details were not specified in the advisory.
Affected products
- Budibase @budibase/server before 3.39.0
Timeline
- 2026-05-21: disclosed: Advisory published on GitHub
- 2026-06-12: advisory: Advisory published to OSV (GHSA-3gp5-q4jw-3v94)
- 2026-05-01: other: Vulnerability observed in origin/master (commit 8e6bf89acf1f602f3334592c4c8cd14e79f5362a), latest release 3.37.2