PT-2026-35071 · Budibase · Budibase

Ayushparkara · Published 2026-04-16 · Updated 2026-05-21 · CVE-2026-41428

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.35.4

Description The authenticated middleware uses unanchored regular expressions to match public endpoint patterns against the ctx.request.url variable. Because ctx.request.url in Koa includes the query string, an attacker can bypass authentication and access protected endpoints by appending a public endpoint path as a query parameter. For example, using the endpoint '/api/global/users/search' with a query parameter like x=/api/system/status allows unauthorized access because the regular expression matches the query string portion of the URL.

Recommendations Update to version 3.35.4.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-41428

GHSA-8783-3WGF-JGGF

Affected Products

Budibase

References · 9

• 🔥 https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf · Exploit
• https://osv.dev/vulnerability/GHSA-8783-3wgf-jggf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41428 · Security Note
• https://github.com/Budibase/budibase · Note
• https://twitter.com/lyrie_ai/status/2057401348568608979 · Twitter Post
• https://twitter.com/lyrie_ai/status/2057401347599700047 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1svdvku/critical_authentication_bypass_in_budibase_opens · Reddit Post
• https://twitter.com/lyrie_ai/status/2057401346647618030 · Twitter Post
• https://twitter.com/CVEnew/status/2047798565993681340 · Twitter Post