EUVD-2026-292976

fkie_cve-2026-41428

Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, POST /api/global/users/search?x=/api/system/status bypasses all authentication because the regex /api/system/status/ matches in the query string portion of the URL. This vulnerability is fixed in 3.35.4.

GHSA-8783-3wgf-jggf — Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected E…

Affected: npm: @budibase/backend-core

### Summary

The `authenticated` middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against `ctx.request.url`. Since `ctx.request.url` in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, `POST /api/global/users/search?x=/api/system/status` bypasses all authentication because the regex `/api/system/status/` matches in the query string portion of the URL.

### Details

**Step 1 — Public endpoint patterns compiled without anchors**

`packages/backend-core/src/middleware/matchers.ts`, line 26:

```typescript return { regex: new RegExp(route), method, route } ```

No `^` prefix, no `$` suffix. The regex matches anywhere in the test string.

**Step 2 — Regex tested against full URL including query string**

`packages/backend-core/src/middleware/matchers.ts`, line 32:

```typescript const urlMatch = regex.test(ctx.request.url) ```

Koa's `ctx.request.url` returns the full URL including query string (e.g., `/api/global/users/search?x=/api/system/status`). The regex `/api/system/status` matches in the query string.

**Step 3 — publicEndpoint flag set to true**

`packages/backend-core/src/middleware/authenticated.ts`, lines 123-125:

```typescript const found = matches(ctx, noAuthOptions) if (found) { publicEndpoint = true } ```

**Step 4 — Worker's global auth check skipped**

`packages/worker/src/api/index.ts`, lines 160-162:

```typescript .us…

WID-SEC-W-2026-1135 — Budibase: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Budibase ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

Most recent entries from all

EUVD-2026-292976

fkie_cve-2026-41428

GHSA-8783-3wgf-jggf — Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected E…

WID-SEC-W-2026-1135 — Budibase: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen