Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-31816

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.4 and earlier, the Budibase server's authorized() middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any request. The isWebhookEndpoint() function uses an unanchored regex that tests against ctx.request.url, which in Koa includes the full URL with query parameters. When the regex matches, the authorized() midd
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:8a3c489ae0b5956b180479d03c9f00a5af6f8266290aa681f08e4196398a5e77
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"budibase","vendor":"Budibase","versions":[{"status":"affected","version":"<= 3.31.4"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e4a43a68b29071bc0456e08d1e61c20779f07610ab67d4c764912f7e53248f98 · sha256:cd52d0ec6d5c1371… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:e4a43a68b29071bc0456e08d1e61c20779f07610ab67d4c764912f7e53248f98 · sha256:cd52d0ec6d5c1371… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-74","description":"CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:e4a43a68b29071bc0456e08d1e61c20779f07610ab67d4c764912f7e53248f98 · sha256:cd52d0ec6d5c1371… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions
{"tags":["exploit"],"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-gw94-hprh-4wj8"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e4a43a68b29071bc0456e08d1e61c20779f07610ab67d4c764912f7e53248f98 · sha256:cd52d0ec6d5c1371… · /containers/adp/0/references/0
{"name":"https://github.com/Budibase/budibase/security/advisories/GHSA-gw94-hprh-4wj8","tags":["x_refsource_CONFIRM"],"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-gw94-hprh-4wj8"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e4a43a68b29071bc0456e08d1e61c20779f07610ab67d4c764912f7e53248f98 · sha256:cd52d0ec6d5c1371… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer