Vulnerability-Lookup

CVE-2026-41428 (GCVE-0-2026-41428)

Vulnerability from cvelistv5 – Published: 2026-04-24 19:17 – Updated: 2026-04-24 20:00

Title

Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints

Summary

Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, POST /api/global/users/search?x=/api/system/status bypasses all authentication because the regex /api/system/status/ matches in the query string portion of the URL. This vulnerability is fixed in 3.35.4.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-24 20:00 UTC

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7643 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Budibase/budibase/security/adv…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
Budibase	budibase	Affected: < 3.35.4	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41428",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-24T20:00:28.868950Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-24T20:00:50.097Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "budibase",
          "vendor": "Budibase",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.35.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, POST /api/global/users/search?x=/api/system/status bypasses all authentication because the regex /api/system/status/ matches in the query string portion of the URL. This vulnerability is fixed in 3.35.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T19:17:29.501Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf"
        }
      ],
      "source": {
        "advisory": "GHSA-8783-3wgf-jggf",
        "discovery": "UNKNOWN"
      },
      "title": "Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher \u2014 Unauthenticated Access to Protected Endpoints"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-41428",
    "datePublished": "2026-04-24T19:17:29.501Z",
    "dateReserved": "2026-04-20T15:32:33.814Z",
    "dateUpdated": "2026-04-24T20:00:50.097Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-41428",
      "date": "2026-10-20",
      "epss": "0.00628",
      "percentile": "0.49167"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "budibase",
                "vendor": "Budibase",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 3.35.4"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DD625C44-6B30-4818-AD5A-9A5DFB303BE9",
                    "versionEndExcluding": "3.35.4",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, POST /api/global/users/search?x=/api/system/status bypasses all authentication because the regex /api/system/status/ matches in the query string portion of the URL. This vulnerability is fixed in 3.35.4."
          }
        ],
        "id": "CVE-2026-41428",
        "lastModified": "2026-06-17T10:46:42.713",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-41428",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-24T20:00:28.868950Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-04-24T20:16:27.523",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:20:54+00:00",
      "cve": "CVE-2026-41428",
      "id": "CVE-2026-41428",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher \u2014 Unauthenticated Access to Protected Endpoints",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41428.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-41428",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-04-24T20:00:28.868950Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-04-24T20:00:46.947Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "budibase",
              "vendor": "Budibase",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 3.35.4"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, POST /api/global/users/search?x=/api/system/status bypasses all authentication because the regex /api/system/status/ matches in the query string portion of the URL. This vulnerability is fixed in 3.35.4."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-287",
                  "description": "CWE-287: Improper Authentication",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-04-24T19:17:29.501Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf"
            }
          ],
          "source": {
            "advisory": "GHSA-8783-3wgf-jggf",
            "discovery": "UNKNOWN"
          },
          "title": "Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher \u2014 Unauthenticated Access to Protected Endpoints"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-41428",
        "datePublished": "2026-04-24T19:17:29.501Z",
        "dateReserved": "2026-04-20T15:32:33.814Z",
        "dateUpdated": "2026-04-24T20:00:50.097Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-41428

Vulnerability from fkie_nvd - Published: 2026-04-24 20:16 - Updated: 2026-06-17 10:46

Severity

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf	Exploit, Mitigation, Vendor Advisory
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf	Exploit, Mitigation, Vendor Advisory

Impacted products

	Vendor	Product	Version
	budibase	budibase	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "budibase",
          "vendor": "Budibase",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.35.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD625C44-6B30-4818-AD5A-9A5DFB303BE9",
              "versionEndExcluding": "3.35.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, POST /api/global/users/search?x=/api/system/status bypasses all authentication because the regex /api/system/status/ matches in the query string portion of the URL. This vulnerability is fixed in 3.35.4."
    }
  ],
  "id": "CVE-2026-41428",
  "lastModified": "2026-06-17T10:46:42.713",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-41428",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-24T20:00:28.868950Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-24T20:16:27.523",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-8783-3WGF-JGGF

Vulnerability from github – Published: 2026-04-16 22:40 – Updated: 2026-04-27 16:19

Summary

Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints

Details

Summary

The authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, POST /api/global/users/search?x=/api/system/status bypasses all authentication because the regex /api/system/status/ matches in the query string portion of the URL.

Details

Step 1 — Public endpoint patterns compiled without anchors

packages/backend-core/src/middleware/matchers.ts, line 26:

return { regex: new RegExp(route), method, route }

No ^ prefix, no $ suffix. The regex matches anywhere in the test string.

Step 2 — Regex tested against full URL including query string

packages/backend-core/src/middleware/matchers.ts, line 32:

const urlMatch = regex.test(ctx.request.url)

Koa's ctx.request.url returns the full URL including query string (e.g., /api/global/users/search?x=/api/system/status). The regex /api/system/status matches in the query string.

Step 3 — publicEndpoint flag set to true

packages/backend-core/src/middleware/authenticated.ts, lines 123-125:

const found = matches(ctx, noAuthOptions)
if (found) {
  publicEndpoint = true
}

Step 4 — Worker's global auth check skipped

packages/worker/src/api/index.ts, lines 160-162:

.use((ctx, next) => {
  if (ctx.publicEndpoint) {
    return next()        // ← SKIPS the auth check below
  }
  if ((!ctx.isAuthenticated || ...) && !ctx.internal) {
    ctx.throw(403, "Unauthorized")   // ← never reached
  }
})

When ctx.publicEndpoint is true, the 403 check at line 165-168 is never executed.

Step 5 — Routes without per-route auth middleware are exposed

loggedInRoutes in packages/worker/src/api/routes/endpointGroups/standard.ts line 23:

export const loggedInRoutes = endpointGroupList.group()   // no middleware

Endpoints on loggedInRoutes have NO secondary auth check. The global check at index.ts:160-169 was their only protection.

Affected endpoints (no per-route auth — fully exposed): - POST /api/global/users/search — search all users (emails, names, roles) - GET /api/global/self — get current user info - GET /api/global/users/accountholder — account holder lookup - GET /api/global/template/definitions — template definitions - POST /api/global/license/refresh — refresh license - POST /api/global/event/publish — publish events

Not affected (have secondary per-route auth that blocks undefined user): - GET /api/global/users — on builderOrAdminRoutes which checks isAdmin(ctx.user) → returns false for undefined → throws 403 - DELETE /api/global/users/:id — on adminRoutes → same secondary check blocks it

PoC

# Step 1: Confirm normal request is blocked
$ curl -s -o /dev/null -w "%{http_code}" \
    -X POST -H "Content-Type: application/json" -d '{}' \
    "https://budibase-instance/api/global/users/search"
403

# Step 2: Bypass auth via query string injection
$ curl -s -X POST -H "Content-Type: application/json" -d '{}' \
    "https://budibase-instance/api/global/users/search?x=/api/system/status"
{"data":[{"email":"admin@example.com","admin":{"global":true},...}],...}

Without auth → 403. With ?x=/api/system/status → returns all users.

Any public endpoint pattern works as the bypass value: - ?x=/api/system/status - ?x=/api/system/environment - ?x=/api/global/configs/public - ?x=/api/global/auth/default

Impact

An unauthenticated attacker can: 1. Enumerate all users — emails, names, roles, admin status, builder status via /api/global/users/search 2. Discover account holder — identify the instance owner via /api/global/users/accountholder 3. Trigger license refresh — potentially disrupt service via /api/global/license/refresh 4. Publish events — inject events into the event system via /api/global/event/publish

The user search is the most damaging — it reveals the full user directory of the Budibase instance to anyone on the internet.

Note: endpoints on builderOrAdminRoutes and adminRoutes are NOT affected because they have secondary middleware (workspaceBuilderOrAdmin, adminOnly) that independently checks ctx.user and throws 403 when it's undefined. Only loggedInRoutes endpoints (which rely solely on the global auth check) are exposed.

Suggested Fix

Two options (both should be applied):

Option A — Anchor the regex:

// matchers.ts line 26
return { regex: new RegExp('^' + route + '(\\?|$)'), method, route }

Option B — Use ctx.request.path instead of ctx.request.url:

// matchers.ts line 32
const urlMatch = regex.test(ctx.request.path)  // excludes query string

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@budibase/backend-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.35.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41428"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-16T22:40:59Z",
    "nvd_published_at": "2026-04-24T20:16:27Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nThe `authenticated` middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against `ctx.request.url`. Since `ctx.request.url` in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, `POST /api/global/users/search?x=/api/system/status` bypasses all authentication because the regex `/api/system/status/` matches in the query string portion of the URL.\n\n### Details\n\n**Step 1 \u2014 Public endpoint patterns compiled without anchors**\n\n`packages/backend-core/src/middleware/matchers.ts`, line 26:\n\n```typescript\nreturn { regex: new RegExp(route), method, route }\n```\n\nNo `^` prefix, no `$` suffix. The regex matches anywhere in the test string.\n\n**Step 2 \u2014 Regex tested against full URL including query string**\n\n`packages/backend-core/src/middleware/matchers.ts`, line 32:\n\n```typescript\nconst urlMatch = regex.test(ctx.request.url)\n```\n\nKoa\u0027s `ctx.request.url` returns the full URL including query string (e.g., `/api/global/users/search?x=/api/system/status`). The regex `/api/system/status` matches in the query string.\n\n**Step 3 \u2014 publicEndpoint flag set to true**\n\n`packages/backend-core/src/middleware/authenticated.ts`, lines 123-125:\n\n```typescript\nconst found = matches(ctx, noAuthOptions)\nif (found) {\n  publicEndpoint = true\n}\n```\n\n**Step 4 \u2014 Worker\u0027s global auth check skipped**\n\n`packages/worker/src/api/index.ts`, lines 160-162:\n\n```typescript\n.use((ctx, next) =\u003e {\n  if (ctx.publicEndpoint) {\n    return next()        // \u2190 SKIPS the auth check below\n  }\n  if ((!ctx.isAuthenticated || ...) \u0026\u0026 !ctx.internal) {\n    ctx.throw(403, \"Unauthorized\")   // \u2190 never reached\n  }\n})\n```\n\nWhen `ctx.publicEndpoint` is `true`, the 403 check at line 165-168 is never executed.\n\n**Step 5 \u2014 Routes without per-route auth middleware are exposed**\n\n`loggedInRoutes` in `packages/worker/src/api/routes/endpointGroups/standard.ts` line 23:\n\n```typescript\nexport const loggedInRoutes = endpointGroupList.group()   // no middleware\n```\n\nEndpoints on `loggedInRoutes` have NO secondary auth check. The global check at `index.ts:160-169` was their only protection.\n\n**Affected endpoints (no per-route auth \u2014 fully exposed):**\n- `POST /api/global/users/search` \u2014 search all users (emails, names, roles)\n- `GET /api/global/self` \u2014 get current user info\n- `GET /api/global/users/accountholder` \u2014 account holder lookup\n- `GET /api/global/template/definitions` \u2014 template definitions\n- `POST /api/global/license/refresh` \u2014 refresh license\n- `POST /api/global/event/publish` \u2014 publish events\n\n**Not affected (have secondary per-route auth that blocks undefined user):**\n- `GET /api/global/users` \u2014 on `builderOrAdminRoutes` which checks `isAdmin(ctx.user)` \u2192 returns false for undefined \u2192 throws 403\n- `DELETE /api/global/users/:id` \u2014 on `adminRoutes` \u2192 same secondary check blocks it\n\n### PoC\n\n```bash\n# Step 1: Confirm normal request is blocked\n$ curl -s -o /dev/null -w \"%{http_code}\" \\\n    -X POST -H \"Content-Type: application/json\" -d \u0027{}\u0027 \\\n    \"https://budibase-instance/api/global/users/search\"\n403\n\n# Step 2: Bypass auth via query string injection\n$ curl -s -X POST -H \"Content-Type: application/json\" -d \u0027{}\u0027 \\\n    \"https://budibase-instance/api/global/users/search?x=/api/system/status\"\n{\"data\":[{\"email\":\"admin@example.com\",\"admin\":{\"global\":true},...}],...}\n```\n\nWithout auth \u2192 403. With `?x=/api/system/status` \u2192 returns all users.\n\nAny public endpoint pattern works as the bypass value:\n- `?x=/api/system/status`\n- `?x=/api/system/environment`\n- `?x=/api/global/configs/public`\n- `?x=/api/global/auth/default`\n\n### Impact\n\nAn unauthenticated attacker can:\n1. **Enumerate all users** \u2014 emails, names, roles, admin status, builder status via `/api/global/users/search`\n2. **Discover account holder** \u2014 identify the instance owner via `/api/global/users/accountholder`\n3. **Trigger license refresh** \u2014 potentially disrupt service via `/api/global/license/refresh`\n4. **Publish events** \u2014 inject events into the event system via `/api/global/event/publish`\n\nThe user search is the most damaging \u2014 it reveals the full user directory of the Budibase instance to anyone on the internet.\n\nNote: endpoints on `builderOrAdminRoutes` and `adminRoutes` are NOT affected because they have secondary middleware (`workspaceBuilderOrAdmin`, `adminOnly`) that independently checks `ctx.user` and throws 403 when it\u0027s undefined. Only `loggedInRoutes` endpoints (which rely solely on the global auth check) are exposed.\n\n### Suggested Fix\n\nTwo options (both should be applied):\n\n**Option A \u2014 Anchor the regex:**\n```typescript\n// matchers.ts line 26\nreturn { regex: new RegExp(\u0027^\u0027 + route + \u0027(\\\\?|$)\u0027), method, route }\n```\n\n**Option B \u2014 Use ctx.request.path instead of ctx.request.url:**\n```typescript\n// matchers.ts line 32\nconst urlMatch = regex.test(ctx.request.path)  // excludes query string\n```",
  "id": "GHSA-8783-3wgf-jggf",
  "modified": "2026-04-27T16:19:34Z",
  "published": "2026-04-16T22:40:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41428"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Budibase/budibase"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher \u2014 Unauthenticated Access to Protected Endpoints"
}

WID-SEC-W-2026-1135

Vulnerability from csaf_certbund - Published: 2026-04-15 22:00 - Updated: 2026-04-26 22:00

Summary

Budibase: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Severity

Hoch

Scope

1 vulnerability in this advisory, including CVE-2026-41428.

CVE-2026-41428

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-41428 (GCVE-0-2026-41428)

FKIE_CVE-2026-41428

GHSA-8783-3WGF-JGGF

Summary

Details

PoC

Impact

Suggested Fix

WID-SEC-W-2026-1135

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour