Most recent entries from all

EUVD-2026-322469

2026-10-10T19:56:22.281589+00:00

EUVD-2026-322469

fkie_cve-2026-45718

2026-10-10T19:56:22.281623+00:00

Budibase is an open-source low-code platform. Prior to 3.38.1, the row action trigger endpoint (POST /api/tables/:sourceId/actions/:actionId/trigger) fails to validate that the user-supplied rowId is within the scope of the view's row filters. A user with access to a filtered view can trigger row actions on any row in the underlying table, including rows explicitly excluded by the view's security filters. This vulnerability is fixed in 3.38.1.

GHSA-3263-v5v9-xq8q — Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows

2026-10-10T19:56:22.281656+00:00

Affected: npm: budibase

## Summary

The row action trigger endpoint (`POST /api/tables/:sourceId/actions/:actionId/trigger`) fails to validate that the user-supplied `rowId` is within the scope of the view's row filters. A user with access to a filtered view can trigger row actions on any row in the underlying table, including rows explicitly excluded by the view's security filters.

## Details

View filters in Budibase are treated as a security boundary. The search path (`packages/server/src/sdk/workspace/rows/search.ts:93-94`) explicitly enforces view query filters with the comment: *"that could let users find rows they should not be allowed to access."*

However, the row action trigger path bypasses this enforcement entirely:

1. **Route** (`packages/server/src/api/routes/rowAction.ts:55-59`): Accepts a `sourceId` that can be a viewId.

2. **Middleware** (`packages/server/src/middleware/triggerRowActionAuthorised.ts:24-55`): Correctly validates that the user has READ permission on the view and that the row action is enabled for that view. However, at line 55 it sets `ctx.params.tableId = tableId` where `tableId` is the **underlying table** extracted from the viewId — the viewId is discarded.

```typescript // triggerRowActionAuthorised.ts:24-26 const tableId = isTableIdOrExternalTableId(sourceId) ? sourceId : getTableIdFromViewId(sourceId) // extracts underlying table

// Line 55: viewId context is lost ctx.params.tableId = tableId ```

3. **Controller** (`packages/server/src/api/controller…

WID-SEC-W-2026-1477 — Budibase: Mehrere Schwachstellen

2026-10-10T19:56:22.281723+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Code auszuführen oder seine Rechte zu erweitern.