Unauthenticated Access to Budibase Apps Exposes Database Contents

CVE-2026-54350

What is CVE-2026-54350?

Budibase, an open-source low-code platform, has a vulnerability that allows unauthenticated visitors to access and manipulate sensitive database documents. This issue primarily affects versions prior to 3.39.12. An attacker can exploit this flaw by sending an HTTP request to a published Budibase app, enabling them to read every document in the associated MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collections. Additionally, if the application's builder has published a 'PUBLIC' write query, the attacker can modify all documents within the collection. The vulnerability arises from inadequate input validation in the query processing logic, allowing crafted inputs to bypass security checks, leading to potential information disclosure and data integrity issues. This critical oversight exemplifies the importance of stringent access controls and proper input sanitization to protect against unauthorized data exposure.

References