NoSQL Injection Vulnerability in Budibase by Budibase
CVE-2026-73617

7.1HIGH

Key Information:

Vendor

Budibase

Status
Server
Vendor
CVE Published:
13 August 2026

What is CVE-2026-73617?

Budibase versions prior to 3.40.0 are at risk due to a NoSQL injection flaw linked to the MongoDB datasource integration. The vulnerability arises when user input is handled using handlebars with noEscaping set to true, allowing adversaries to introduce MongoDB operators through query parameters. This misconfiguration leads to the potential bypass of user-specific access controls, unauthorized access to documents, execution of arbitrary JavaScript via the $where operator, and the ability to modify collections through operations such as update and delete.

Affected Version(s)

server 0 < 3.40.0

server 3.40.0

References

https://github.com/Budibase/budibase/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/budibase-before-nosq...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

adrgs
aisafe-bot
.