Vulnerability-Lookup

GHSA-8783-3WGF-JGGF

Vulnerability from github – Published: 2026-04-16 22:40 – Updated: 2026-04-16 22:40

Summary

Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints

Details

Summary

The authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, POST /api/global/users/search?x=/api/system/status bypasses all authentication because the regex /api/system/status/ matches in the query string portion of the URL.

Details

Step 1 — Public endpoint patterns compiled without anchors

packages/backend-core/src/middleware/matchers.ts, line 26:

return { regex: new RegExp(route), method, route }

No ^ prefix, no $ suffix. The regex matches anywhere in the test string.

Step 2 — Regex tested against full URL including query string

packages/backend-core/src/middleware/matchers.ts, line 32:

const urlMatch = regex.test(ctx.request.url)

Koa's ctx.request.url returns the full URL including query string (e.g., /api/global/users/search?x=/api/system/status). The regex /api/system/status matches in the query string.

Step 3 — publicEndpoint flag set to true

packages/backend-core/src/middleware/authenticated.ts, lines 123-125:

const found = matches(ctx, noAuthOptions)
if (found) {
  publicEndpoint = true
}

Step 4 — Worker's global auth check skipped

packages/worker/src/api/index.ts, lines 160-162:

.use((ctx, next) => {
  if (ctx.publicEndpoint) {
    return next()        // ← SKIPS the auth check below
  }
  if ((!ctx.isAuthenticated || ...) && !ctx.internal) {
    ctx.throw(403, "Unauthorized")   // ← never reached
  }
})

When ctx.publicEndpoint is true, the 403 check at line 165-168 is never executed.

Step 5 — Routes without per-route auth middleware are exposed

loggedInRoutes in packages/worker/src/api/routes/endpointGroups/standard.ts line 23:

export const loggedInRoutes = endpointGroupList.group()   // no middleware

Endpoints on loggedInRoutes have NO secondary auth check. The global check at index.ts:160-169 was their only protection.

Affected endpoints (no per-route auth — fully exposed): - POST /api/global/users/search — search all users (emails, names, roles) - GET /api/global/self — get current user info - GET /api/global/users/accountholder — account holder lookup - GET /api/global/template/definitions — template definitions - POST /api/global/license/refresh — refresh license - POST /api/global/event/publish — publish events

Not affected (have secondary per-route auth that blocks undefined user): - GET /api/global/users — on builderOrAdminRoutes which checks isAdmin(ctx.user) → returns false for undefined → throws 403 - DELETE /api/global/users/:id — on adminRoutes → same secondary check blocks it

PoC

# Step 1: Confirm normal request is blocked
$ curl -s -o /dev/null -w "%{http_code}" \
    -X POST -H "Content-Type: application/json" -d '{}' \
    "https://budibase-instance/api/global/users/search"
403

# Step 2: Bypass auth via query string injection
$ curl -s -X POST -H "Content-Type: application/json" -d '{}' \
    "https://budibase-instance/api/global/users/search?x=/api/system/status"
{"data":[{"email":"admin@example.com","admin":{"global":true},...}],...}

Without auth → 403. With ?x=/api/system/status → returns all users.

Any public endpoint pattern works as the bypass value: - ?x=/api/system/status - ?x=/api/system/environment - ?x=/api/global/configs/public - ?x=/api/global/auth/default

Impact

An unauthenticated attacker can: 1. Enumerate all users — emails, names, roles, admin status, builder status via /api/global/users/search 2. Discover account holder — identify the instance owner via /api/global/users/accountholder 3. Trigger license refresh — potentially disrupt service via /api/global/license/refresh 4. Publish events — inject events into the event system via /api/global/event/publish

The user search is the most damaging — it reveals the full user directory of the Budibase instance to anyone on the internet.

Note: endpoints on builderOrAdminRoutes and adminRoutes are NOT affected because they have secondary middleware (workspaceBuilderOrAdmin, adminOnly) that independently checks ctx.user and throws 403 when it's undefined. Only loggedInRoutes endpoints (which rely solely on the global auth check) are exposed.

Suggested Fix

Two options (both should be applied):

Option A — Anchor the regex:

// matchers.ts line 26
return { regex: new RegExp('^' + route + '(\\?|$)'), method, route }

Option B — Use ctx.request.path instead of ctx.request.url:

// matchers.ts line 32
const urlMatch = regex.test(ctx.request.path)  // excludes query string

Severity ?

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@budibase/backend-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.35.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-16T22:40:59Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nThe `authenticated` middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against `ctx.request.url`. Since `ctx.request.url` in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, `POST /api/global/users/search?x=/api/system/status` bypasses all authentication because the regex `/api/system/status/` matches in the query string portion of the URL.\n\n### Details\n\n**Step 1 \u2014 Public endpoint patterns compiled without anchors**\n\n`packages/backend-core/src/middleware/matchers.ts`, line 26:\n\n```typescript\nreturn { regex: new RegExp(route), method, route }\n```\n\nNo `^` prefix, no `$` suffix. The regex matches anywhere in the test string.\n\n**Step 2 \u2014 Regex tested against full URL including query string**\n\n`packages/backend-core/src/middleware/matchers.ts`, line 32:\n\n```typescript\nconst urlMatch = regex.test(ctx.request.url)\n```\n\nKoa\u0027s `ctx.request.url` returns the full URL including query string (e.g., `/api/global/users/search?x=/api/system/status`). The regex `/api/system/status` matches in the query string.\n\n**Step 3 \u2014 publicEndpoint flag set to true**\n\n`packages/backend-core/src/middleware/authenticated.ts`, lines 123-125:\n\n```typescript\nconst found = matches(ctx, noAuthOptions)\nif (found) {\n  publicEndpoint = true\n}\n```\n\n**Step 4 \u2014 Worker\u0027s global auth check skipped**\n\n`packages/worker/src/api/index.ts`, lines 160-162:\n\n```typescript\n.use((ctx, next) =\u003e {\n  if (ctx.publicEndpoint) {\n    return next()        // \u2190 SKIPS the auth check below\n  }\n  if ((!ctx.isAuthenticated || ...) \u0026\u0026 !ctx.internal) {\n    ctx.throw(403, \"Unauthorized\")   // \u2190 never reached\n  }\n})\n```\n\nWhen `ctx.publicEndpoint` is `true`, the 403 check at line 165-168 is never executed.\n\n**Step 5 \u2014 Routes without per-route auth middleware are exposed**\n\n`loggedInRoutes` in `packages/worker/src/api/routes/endpointGroups/standard.ts` line 23:\n\n```typescript\nexport const loggedInRoutes = endpointGroupList.group()   // no middleware\n```\n\nEndpoints on `loggedInRoutes` have NO secondary auth check. The global check at `index.ts:160-169` was their only protection.\n\n**Affected endpoints (no per-route auth \u2014 fully exposed):**\n- `POST /api/global/users/search` \u2014 search all users (emails, names, roles)\n- `GET /api/global/self` \u2014 get current user info\n- `GET /api/global/users/accountholder` \u2014 account holder lookup\n- `GET /api/global/template/definitions` \u2014 template definitions\n- `POST /api/global/license/refresh` \u2014 refresh license\n- `POST /api/global/event/publish` \u2014 publish events\n\n**Not affected (have secondary per-route auth that blocks undefined user):**\n- `GET /api/global/users` \u2014 on `builderOrAdminRoutes` which checks `isAdmin(ctx.user)` \u2192 returns false for undefined \u2192 throws 403\n- `DELETE /api/global/users/:id` \u2014 on `adminRoutes` \u2192 same secondary check blocks it\n\n### PoC\n\n```bash\n# Step 1: Confirm normal request is blocked\n$ curl -s -o /dev/null -w \"%{http_code}\" \\\n    -X POST -H \"Content-Type: application/json\" -d \u0027{}\u0027 \\\n    \"https://budibase-instance/api/global/users/search\"\n403\n\n# Step 2: Bypass auth via query string injection\n$ curl -s -X POST -H \"Content-Type: application/json\" -d \u0027{}\u0027 \\\n    \"https://budibase-instance/api/global/users/search?x=/api/system/status\"\n{\"data\":[{\"email\":\"admin@example.com\",\"admin\":{\"global\":true},...}],...}\n```\n\nWithout auth \u2192 403. With `?x=/api/system/status` \u2192 returns all users.\n\nAny public endpoint pattern works as the bypass value:\n- `?x=/api/system/status`\n- `?x=/api/system/environment`\n- `?x=/api/global/configs/public`\n- `?x=/api/global/auth/default`\n\n### Impact\n\nAn unauthenticated attacker can:\n1. **Enumerate all users** \u2014 emails, names, roles, admin status, builder status via `/api/global/users/search`\n2. **Discover account holder** \u2014 identify the instance owner via `/api/global/users/accountholder`\n3. **Trigger license refresh** \u2014 potentially disrupt service via `/api/global/license/refresh`\n4. **Publish events** \u2014 inject events into the event system via `/api/global/event/publish`\n\nThe user search is the most damaging \u2014 it reveals the full user directory of the Budibase instance to anyone on the internet.\n\nNote: endpoints on `builderOrAdminRoutes` and `adminRoutes` are NOT affected because they have secondary middleware (`workspaceBuilderOrAdmin`, `adminOnly`) that independently checks `ctx.user` and throws 403 when it\u0027s undefined. Only `loggedInRoutes` endpoints (which rely solely on the global auth check) are exposed.\n\n### Suggested Fix\n\nTwo options (both should be applied):\n\n**Option A \u2014 Anchor the regex:**\n```typescript\n// matchers.ts line 26\nreturn { regex: new RegExp(\u0027^\u0027 + route + \u0027(\\\\?|$)\u0027), method, route }\n```\n\n**Option B \u2014 Use ctx.request.path instead of ctx.request.url:**\n```typescript\n// matchers.ts line 32\nconst urlMatch = regex.test(ctx.request.path)  // excludes query string\n```",
  "id": "GHSA-8783-3wgf-jggf",
  "modified": "2026-04-16T22:40:59Z",
  "published": "2026-04-16T22:40:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Budibase/budibase"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher \u2014 Unauthenticated Access to Protected Endpoints"
}

CVE-2026-41428 (GCVE-0-2026-41428)

Vulnerability from cvelistv5 – Published: 2026-04-24 19:17 – Updated: 2026-04-24 20:00

Title

Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints

Summary

Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, POST /api/global/users/search?x=/api/system/status bypasses all authentication because the regex /api/system/status/ matches in the query string portion of the URL. This vulnerability is fixed in 3.35.4.

Severity ?

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M

References

URL

Tags

https://github.com/Budibase/budibase/security/adv…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Budibase	budibase	Affected: < 3.35.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41428",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-24T20:00:28.868950Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-24T20:00:50.097Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "budibase",
          "vendor": "Budibase",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.35.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, POST /api/global/users/search?x=/api/system/status bypasses all authentication because the regex /api/system/status/ matches in the query string portion of the URL. This vulnerability is fixed in 3.35.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T19:17:29.501Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-8783-3wgf-jggf"
        }
      ],
      "source": {
        "advisory": "GHSA-8783-3wgf-jggf",
        "discovery": "UNKNOWN"
      },
      "title": "Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher \u2014 Unauthenticated Access to Protected Endpoints"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-41428",
    "datePublished": "2026-04-24T19:17:29.501Z",
    "dateReserved": "2026-04-20T15:32:33.814Z",
    "dateUpdated": "2026-04-24T20:00:50.097Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-8783-3WGF-JGGF

Summary

Details

PoC

Impact

Suggested Fix

CVE-2026-41428 (GCVE-0-2026-41428)

Tags

Sightings

Nomenclature