Description

Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. Attackers can inject resources by specifying an arbitrary destination workspace ID in the request body, then trigger injected automations with outgoing webhooks to exfiltrate data from victim applications.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-28T12:16:34.317Z",
  "pubdate": "2026-08-28T12:16:34.317Z",
  "executiveSummary": "A missing authorization vulnerability exists within Budibase versions prior to 3.41.3, specifically located in the POST /api/resources/duplicate endpoint.\nThis flaw allows an authenticated builder to bypass access control mechanisms and inject unauthorized resources, including tables, automations, queries, and screens, into any arbitrary application within the instance.\nThe vulnerability occurs because the backend fails to validate whether the authenticated user possesses sufficient privileges within the targeted destination workspace.\nBy manipulating the request body to specify a foreign workspace ID, an attacker can cross security boundaries to modify external applications.\nThe risk implication is significant, as successful exploitation enables the injection of malicious automations that can be configured to trigger outgoing webhooks.\nSuch capabilities allow an attacker to exfiltrate sensitive data from the victim's application to an attacker-controlled endpoint.\nThe exploit requires the attacker to be an authenticated builder within the Budibase environment, meaning the vulnerability is essentially a privilege escalation and cross-workspace access flaw.\nThe severity is elevated due to the potential for automated data harvesting and unauthorized state modification of applications residing in workspaces where the attacker should have zero visibility or management rights.",
  "technicalDetails": "The root cause of this vulnerability is improper access control validation within the Budibase API layer, specifically at the POST /api/resources/duplicate endpoint.\nWhen a user triggers the duplicate resource functionality, the application logic fails to perform a secondary authorization check to verify if the requester has valid permissions or membership in the destination workspace identifier provided in the request payload.\nIn a secure implementation, the server should validate the user's role against the target workspace ID before processing the resource duplication logic. Due to this missing authorization check, the application implicitly trusts the workspace ID provided by the client.\nThe attack flow proceeds as follows: First, the attacker, possessing legitimate builder credentials within any workspace, identifies a target workspace ID. The attacker then constructs a crafted POST request directed to /api/resources/duplicate. Within the JSON request body, the attacker specifies the target workspace ID and the resource definitions they intend to inject.\nOnce the request is submitted, the backend processes the request as if it were a legitimate internal operation, effectively cloning the specified resources into the target workspace regardless of the attacker's actual role in that environment.\nThe post-exploitation impact is critical. By injecting resources, an attacker can introduce malicious automations into the target application. These automations can be configured to execute upon specific events or timers, utilizing outgoing webhooks to transmit the contents of tables, query results, or application data to external servers controlled by the attacker.\nThis behavior facilitates silent data exfiltration without requiring direct access to the victim's workspace dashboard. Furthermore, the ability to inject queries and screens allows for deeper persistent manipulation of the target application's infrastructure. The vulnerability affects all Budibase versions prior to 3.41.3. As this is an API-based vulnerability, the network exposure is limited to those who can reach the Budibase API interface, but the functional exposure is total for any instance where multi-tenancy or multiple workspaces are utilized by different users."
}