PT-2026-44058 · Budibase · Budibase

B-Hermes · Published 2026-05-27 · Updated 2026-06-12 · CVE-2026-48147

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.35.4

Description The buildMatcherRegex() and matches() functions in packages/backend-core/src/middleware/matchers.ts compile route patterns into unanchored regular expressions and test them against ctx.request.url, which includes the full query string. The CSRF middleware uses this system to determine if CSRF token validation should be skipped. An unauthenticated attacker can bypass CSRF token validation for any Worker API endpoint by injecting a public route pattern into the query string. This allows the execution of state-changing cross-origin requests, such as modifying global configuration, managing users, and sending admin invites.

Recommendations Update to version 3.35.4.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

CWE-185

Related Identifiers

CVE-2026-48147

GHSA-WXQ7-X3QP-VCR8

Affected Products

Budibase

References · 5

• 🔥 https://github.com/Budibase/budibase/security/advisories/GHSA-wxq7-x3qp-vcr8 · Exploit
• https://osv.dev/vulnerability/GHSA-wxq7-x3qp-vcr8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48147 · Security Note
• https://github.com/Budibase/budibase · Note
• https://twitter.com/CVEnew/status/2059718125969608740 · Twitter Post