CVE-2026-54350: Budibase: unauthenticated data read and write via PUBLIC app queries
Budibase versions before 3.39.12 let an unauthenticated visitor of a published app read, and in some configurations modify, documents in backing data stores when the builder has exposed a query with the PUBLIC role. The flaw comes from unsafe construction of JSON query bodies from user-supplied parameters, and the advisory states it is fixed in 3.39.12. NVD rates it 9.8 (critical) under CVSS 3.1, and no confirmed exploitation appears in the sources consulted.
Overview
The advisory describes a flaw in Budibase, an open-source low-code platform, in which query parameters are inserted into a raw JSON body and then parsed without adequate escaping. Queries marked with the PUBLIC role can be reached without a session through a published app, so the flaw is reachable by unauthenticated visitors. The record states the issue is fixed in 3.39.12.
Impact
- Per the record, an unauthenticated visitor could read every document in the backing data collection of the affected query, across MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL and REST-with-JSON-body integrations.
- Where the builder published a PUBLIC write query, the record states the collection could be modified with one HTTP request.
- NVD assigns CVSS 3.1 base score 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and the GitHub CNA score in the record is 10.
Affected products and versions
- Budibase Budibase, versions before 3.39.12, according to the affected entry in the record.
- The record does not list a fixed-version field, but the description states the vulnerability is fixed in 3.39.12.
Exploitation status
CISA KEV does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted. The GitHub advisory reference carries an Exploit tag in the record metadata, which does not by itself confirm that exploitation has occurred or that public exploit code exists.
Remediation and mitigation
- Upgrade Budibase to version 3.39.12 or later, as stated by the advisory description.
- Until upgraded, review which queries on published apps use the PUBLIC role and restrict them to authenticated roles where the business need allows.
- Review whether PUBLIC write queries are necessary at all, and remove or limit them.
- Consult the GitHub security advisory for vendor guidance.
Detection guidance
- Review web server and application logs for unauthenticated requests to the query execution endpoint on published apps, especially unusual volumes or requests against write-capable queries.
- Audit backing data stores for unexpected bulk reads or modifications in the period before the upgrade.
- Compare the list of PUBLIC-role queries against the expected configuration to identify exposure.
Limitations of the available information
- The record does not state a lower bound on affected versions.
- The structured CWE field lists CWE-89 (SQL Injection), while the description describes unescaped JSON construction; the mapping is not explained in the record.
- The title field was null in the record and no exploitation details beyond the description are provided.
- It is unknown whether public exploit code exists or whether any environment was compromised.
Frequently asked questions
Which Budibase versions are affected by CVE-2026-54350?
The record lists Budibase versions before 3.39.12 as affected, and the description states the vulnerability is fixed in 3.39.12.
Does this vulnerability require a login?
According to the record, the request is accepted without a session, using only the public app identifier header from a published app URL, so no login is described as required. The attack surface depends on the builder having exposed a query with the PUBLIC role.
Is this CVE known to be actively exploited?
No. CISA KEV does not list it, and no confirmed exploitation in the wild appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.