CVE Feed

    Dashboard / CVE / CVE-2026-100681

    CVE-2026-100681

    Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an attacker-controlled serviceUrl that is persisted and used for all subsequent bot replies, causing the server to send live Microsoft OAuth access tokens in Authorization headers to the attacker's host and enabling blind internal network access.

    Published:Sep 26, 2026
    Last Modified:Sep 30, 2026
    EPS:Sep 26, 2026
    EPSS Score:0.00249
    CVSS Score:5.4

    Affected Products

    Vendor
    Budibase
    Product
    Server

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-918 Server-Side Request Forgery

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2026-100688 (CVSS 7.1) — Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/app…
    CVE-2026-100687 (CVSS 7) — Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external ta…
    CVE-2026-100686 (CVSS 8.6) — Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId…
    CVE-2026-100685 (CVSS 8.3) — Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builder…
    CVE-2026-100684 (CVSS 9.2) — Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibas…
    CVE-2026-100683 (CVSS 8.9) — Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/sr…
    CVE-2026-100682 (CVSS 8.7) — Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint t…
    CVE-2026-100680 (CVSS 8.6) — Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger impo…
    CVE-2026-82246 (CVSS 7.1) — Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoin…
    CVE-2026-82245 (CVSS 7.2) — Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High