CVE Feed

    Dashboard / CVE / CVE-2026-100688

    CVE-2026-100688

    Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrieve sensitive application details including navigation structure, role names, internal screen URLs, JavaScript snippets, and user identifiers without authorization checks.

    Published:Sep 26, 2026
    Last Modified:Sep 28, 2026
    EPS:Sep 26, 2026
    EPSS Score:0.00262
    CVSS Score:6.5

    Affected Products

    Vendor
    Budibase
    Product
    Server

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-100687 (CVSS 7) — Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external ta…
    CVE-2026-100686 (CVSS 8.6) — Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId…
    CVE-2026-100685 (CVSS 8.3) — Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builder…
    CVE-2026-100684 (CVSS 9.2) — Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibas…
    CVE-2026-100683 (CVSS 8.9) — Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/sr…
    CVE-2026-100682 (CVSS 8.7) — Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint t…
    CVE-2026-100681 (CVSS 6.3) — Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vul…
    CVE-2026-100680 (CVSS 8.6) — Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger impo…
    CVE-2026-82246 (CVSS 7.1) — Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoin…
    CVE-2026-82245 (CVSS 7.2) — Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High