CVE-2026-82242: Budibase Authorization Bypass Vulnerability

CVE-2026-82242 Overview

CVE-2026-82242 is a missing authorization vulnerability [CWE-862] in Budibase versions before 3.41.3. The flaw resides in the POST /api/resources/duplicate endpoint. Authenticated builders can inject tables, automations, queries, and screens into any other application without holding a role in the destination workspace. Attackers specify an arbitrary destination workspace ID in the request body, then trigger the injected automations through outgoing webhooks to exfiltrate data from victim applications.

Critical Impact
An authenticated builder in one workspace can compromise integrity and exfiltrate data from unrelated workspaces on the same Budibase instance by injecting malicious resources cross-application.

Affected Products

Budibase versions before 3.41.3
Self-hosted Budibase deployments exposing the /api/resources/duplicate endpoint
Multi-tenant Budibase instances with more than one builder account

Discovery Timeline

2026-08-28 - CVE-2026-82242 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82242

Vulnerability Analysis

Budibase is a low-code platform used to build internal tools, dashboards, and workflows. The POST /api/resources/duplicate endpoint duplicates resources such as tables, automations, queries, and screens into a target workspace. The endpoint validates that the caller is an authenticated builder but does not verify that the caller holds a role in the destination workspace identified in the request body.

This missing authorization check allows any builder on the instance to write resources into applications they do not own. Once an attacker injects an automation, they can trigger it through outgoing webhooks. The automation executes in the victim workspace's context, giving the attacker read and write access to the victim's data, queries, and integrations.

Root Cause

The root cause is a missing authorization control on the destination workspace parameter. The duplicate endpoint trusts the destination workspace ID supplied in the request body without confirming that the authenticated principal has a role in that workspace. This is a classic broken access control pattern where authentication is verified but authorization is delegated to client-supplied input.

Attack Vector

The attack requires network access to the Budibase API and low privileges in the form of a valid builder account. No user interaction is required. The attacker sends a crafted POST request to /api/resources/duplicate specifying a target workspace ID belonging to another tenant or team. The server duplicates the specified resource, such as a malicious automation, into the victim workspace. The attacker then invokes the automation using an outbound webhook trigger, exfiltrating data through the injected workflow.

Refer to the GitHub Security Advisory GHSA-xqpq-288m-r5q7 and the VulnCheck Advisory for Budibase for technical details.

Detection Methods for CVE-2026-82242

Indicators of Compromise

Requests to POST /api/resources/duplicate where the destination workspace ID in the body does not match a workspace the requesting user belongs to.
Newly created automations, queries, tables, or screens in a workspace with no corresponding builder activity from that workspace's members.
Outbound webhook calls from Budibase automations to attacker-controlled domains shortly after resource creation events.

Detection Strategies

Correlate application audit logs of resource creation with the identity and workspace membership of the acting user. Flag mismatches between actor workspace and target workspace.
Alert on any automation trigger whose creation timestamp precedes execution by only seconds or minutes and originates from a user outside the workspace.
Monitor for anomalous outbound HTTP requests from Budibase servers to previously unseen external hosts, particularly following calls to the duplicate endpoint.

Monitoring Recommendations

Enable and centralize Budibase audit logs and forward them to a SIEM for correlation across workspaces.
Track builder-to-workspace membership changes and diff them against resource creation events on a scheduled basis.
Baseline the volume of duplicate API calls per builder and alert on outliers or first-time cross-workspace duplications.

How to Mitigate CVE-2026-82242

Immediate Actions Required

Upgrade all Budibase deployments to version 3.41.3 or later without delay.
Audit every workspace for automations, queries, tables, and screens created by non-member builders since the last known-good backup.
Rotate secrets, API keys, and database credentials referenced by any automation or query that cannot be verified as legitimate.
Review outbound webhook destinations configured in automations and remove any pointing to unknown external endpoints.

Patch Information

The Budibase maintainers fixed CVE-2026-82242 in version 3.41.3 by adding an authorization check on the destination workspace parameter of the POST /api/resources/duplicate endpoint. Details are published in the GitHub Security Advisory GHSA-xqpq-288m-r5q7.

Workarounds

If immediate upgrade is not feasible, restrict access to the /api/resources/duplicate endpoint at the reverse proxy or API gateway layer.
Reduce the number of accounts with the builder role to trusted operators only until the patch is applied.
Disable outbound webhook actions in automations on shared instances to limit the exfiltration path while patching is scheduled.

bash

# Configuration example: block the vulnerable endpoint at NGINX until patched
location /api/resources/duplicate {
    return 403;
}