Description

Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query requests with target table identifiers to bypass table-level access controls and manipulate restricted data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-28T12:16:33.887Z",
  "pubdate": "2026-08-28T12:16:33.887Z",
  "executiveSummary": "Budibase versions prior to 3.41.3 contain a critical broken access control vulnerability within the API layer.\nThe vulnerability resides in the /api/datasources/query endpoint, which fails to enforce per-table role-based access control (RBAC) policies.\nThis flaw allows users assigned the low-privilege BASIC role to perform unauthorized CRUD (Create, Read, Update, Delete) operations on tables they are otherwise restricted from accessing.\nThe risk is severe, as it permits lateral data access and unauthorized manipulation of sensitive information across the entire data infrastructure of the application.\nExploitation does not require elevated privileges beyond the BASIC role, and attackers can trigger the flaw by submitting crafted requests containing target table identifiers that should be off-limits to their assigned role.\nThis represents a failure in the application's authorization mechanism, where the server-side logic trusts user-supplied inputs regarding table access rather than validating these against established security policies.",
  "technicalDetails": "The root cause of this vulnerability is an inadequate implementation of authorization checks within the /api/datasources/query endpoint controller in Budibase versions before 3.41.3.\nWhile the application defines table-level security configurations, the endpoint fails to verify if the authenticated user has appropriate permissions to interact with the specific data source or table requested during the query execution process.\nThe attack flow initiates when an attacker with a standard BASIC role session authenticates to the Budibase instance. Instead of interacting with the UI-driven workflows, the attacker intercepts or manually constructs a POST request to /api/datasources/query.\nIn the request payload, the attacker specifies the target datasource and the sensitive table identifier. Because the backend logic lacks a secondary validation layer to confirm the user's role against the permissions defined for that specific table, the API processes the request as if it were a legitimate administrative action.\nThe endpoint functions as a pass-through for database operations, and by neglecting to scope the query execution to the user's authorized tables, the system allows the attacker to execute arbitrary SQL or NoSQL commands on restricted tables.\nImpact includes complete data exposure (unauthorized read) and data integrity compromise (unauthorized write/delete), effectively bypassing the entire security model for Budibase data management.\nThe exploitation requirement is limited to an existing user account with the BASIC role. No sophisticated injection techniques are required beyond identifying the internal table identifiers, which can often be discovered through metadata introspection or observed traffic patterns.\nThis vulnerability highlights a flaw in the application's design where authorization logic is bypassed during the direct API interaction phase, leading to insecure direct object reference (IDOR)-style behavior at the functional level."
}