CVE-2026-100688 Details
Description
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrieve sensitive application details including navigation structure, role names, internal screen URLs, JavaScript snippets, and user identifiers without authorization checks.
A cross-tenant information disclosure vulnerability has been identified in Budibase Server versions prior to 3.45.0. This vulnerability exists in the GET /api/applications/:appId/appPackage endpoint, allowing authenticated users to access another tenant's application metadata and source code. Exploitation involves supplying a victim tenant's app ID to retrieve sensitive details such as navigation structure, role names, internal screen URLs, JavaScript snippets, and user identifiers, all without proper authorization checks.
Users are advised to update Budibase Server to version 3.45.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026CISA-ADP
Assessed Sep 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Budibase/budibase/security/advisories/GHSA-4946-qf2m-wrh5 | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/Budibase/budibase/security/advisories/GHSA-4946-qf2m-wrh5 | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/budibase-server-before-3.45.0-cross-tenant-information-disclosure | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Budibase | < 3.45.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | [email protected] |
| Sep 28, 2026 | CVE Modified | CISA-ADP |
| Sep 26, 2026 | New CVE Received | [email protected] |