CVE-2026-82239: Budibase Authentication Bypass Vulnerability

CVE-2026-82239 Overview

CVE-2026-82239 is an authorization bypass vulnerability in Budibase versions prior to 3.41.3. The application fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint. Low-privilege users assigned the BASIC role can read, create, update, or delete rows in any table, ignoring configured table-level permissions. The flaw maps to CWE-862: Missing Authorization and is exploitable over the network with only low privileges required.

Critical Impact
Any authenticated BASIC user can bypass table-level access controls to read and manipulate restricted data across every table reachable through the datasources query endpoint.

Affected Products

Budibase versions before 3.41.3
Self-hosted Budibase deployments exposing the /api/datasources/query endpoint
Multi-tenant Budibase installations relying on role-based table permissions

Discovery Timeline

2026-08-28 - CVE-2026-82239 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82239

Vulnerability Analysis

Budibase implements role-based access control (RBAC) to restrict which users can read or modify rows within specific tables. The permission model is enforced at the standard row-access endpoints. However, the POST /api/datasources/query endpoint accepts a target table identifier in the request body and executes the requested query without validating that the caller's role permits the requested operation on that table.

A user holding the BASIC role, the lowest authenticated role tier in Budibase, can submit crafted query requests targeting tables that should be restricted to elevated roles. The server processes the query and returns results or applies mutations. This exposes both confidentiality and integrity of application data across the deployment.

Root Cause

The root cause is a missing authorization check on the datasources query path. Per-table role restrictions are configured through the RBAC layer but are not consulted before the query executor runs against the specified table. The endpoint trusts the authenticated session's baseline permission to access datasources rather than re-evaluating the effective table permission for the requested operation.

Attack Vector

An attacker requires a valid BASIC user account on a vulnerable Budibase instance. From that session, the attacker sends a POST request to /api/datasources/query with a body specifying the target datasource, table identifier, and the desired operation such as read, create, update, or delete. The server performs the operation and returns the response.

Because the vulnerability requires only low privileges and no user interaction, self-service Budibase deployments with open sign-up or generous default role assignment are particularly exposed. Attackers can enumerate table identifiers and iterate operations to exfiltrate or destructively modify restricted data.

Detection Methods for CVE-2026-82239

Indicators of Compromise

Unexpected POST requests to /api/datasources/query originating from users with the BASIC role.
Query bodies referencing table identifiers that the calling user should not have access to under configured RBAC.
Row-level create, update, or delete operations recorded in audit logs against restricted tables without a corresponding privileged session.

Detection Strategies

Correlate application access logs with the RBAC configuration and alert when a BASIC-role user issues query operations against tables mapped to higher-privileged roles.
Baseline normal usage of /api/datasources/query per user and flag deviations in request volume, table diversity, or write operations.
Monitor Budibase version strings exposed through admin APIs to identify hosts still running versions earlier than 3.41.3.

Monitoring Recommendations

Enable verbose audit logging for datasource queries and forward logs to a centralized analytics platform for retention and search.
Track privilege-to-action mismatches by joining authentication events with row mutation events across all datasources.
Alert on bulk read patterns from a single BASIC user against multiple distinct tables within a short time window.

How to Mitigate CVE-2026-82239

Immediate Actions Required

Upgrade all Budibase instances to version 3.41.3 or later without delay.
Audit existing BASIC-role accounts and revoke any accounts that are inactive, shared, or unnecessarily provisioned.
Review audit logs for suspicious activity against /api/datasources/query covering the period since the endpoint was introduced.

Patch Information

The issue is fixed in Budibase 3.41.3. Upgrade guidance and the fix commit are documented in the GitHub Security Advisory GHSA-vq3j-xwg3-pg8x and the VulnCheck Advisory for Budibase.

Workarounds

Restrict network reachability of the Budibase application to trusted users through a reverse proxy or VPN until patching is complete.
Disable self-service registration and manually provision accounts to limit the population of BASIC-role users.
Apply web application firewall rules to block or heavily rate-limit POST /api/datasources/query requests from non-administrative sessions until the upgrade is applied.

bash

# Example WAF rule concept: block datasources query from low-privileged sessions
# Adjust to match your reverse proxy or WAF syntax
location = /api/datasources/query {
    if ($http_x_user_role = "BASIC") {
        return 403;
    }
    proxy_pass http://budibase_upstream;
}