Executive brief
Budibase is a low-code platform that allows users to build database-backed applications. A flaw in the resource duplication endpoint allows any authenticated builder to inject tables, automations, queries, and screens into applications they don't have access to. An attacker could weaponize injected automations with webhooks to steal data from victim applications, potentially exposing sensitive information across multiple internal apps.
Technical details
A missing authorization vulnerability exists in the POST /api/resources/duplicate endpoint that fails to validate whether the authenticated user holds builder rights on the destination workspace. The endpoint accepts a toWorkspace parameter from the request body and performs bulk-writes of resource documents (tables, automations, queries, screens) directly to the destination database with no ownership or tenant validation. An authenticated builder on any application can discover other workspace IDs via the public GET /api/applications endpoint and inject arbitrary resources into cross-tenant applications in multi-tenant deployments. By injecting automations containing outgoing webhook steps, attackers can exfiltrate data from victim applications when the automations are triggered. The vulnerability has been patched in version 3.41.3.
Affected products
- Budibase Budibase before 3.41.3
Timeline
- 2026-08-14: disclosed
- 2026-08-28: advisory
- 2026-08-28: patched: version 3.41.3