PT-2026-44063 · Budibase · Budibase

Mjashank · Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-48152

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.0

Description Insufficient permission checks on the single-datasource 'GET' and 'PUT' routes allow users with the Basic app user role to access and modify REST datasource configurations. Because these routes are guarded by generic TABLE READ permissions rather than Builder/Admin or ownership checks, a Basic user can update the config.url variable while maintaining redacted placeholders. When the mergeConfigs() function is called during an update, it restores the stored secret. Subsequently, during query execution, the platform prefixes the attacker-controlled config.url to the relative query path and applies the resolved stored authentication headers, leading to the server-side disclosure of the REST Authorization secret to an external listener.

Recommendations Update to version 3.39.0.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-48152

Affected Products

Budibase

References · 4

• 🔥 https://github.com/Budibase/budibase/security/advisories/GHSA-3gp5-q4jw-3v94 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-48152 · Security Note
• https://twitter.com/CVEnew/status/2059718144873345502 · Twitter Post
• https://twitter.com/infoflowcloud/status/2059719157449441305 · Twitter Post