CVE-2026-72859

COMPONENT VERSION RANGE

NewScan fingerprints Budibase from its response and reports this CVE when the detected version falls inside the affected range below.

MEASURED 2026-08-14 against vulhub/budibase 3.31.4 (training/cve budibase-idor). The version arrives from the tech_signatures "Budibase" version_from on /api/system/status, which answers anonymously with {"health":{"passing":true},"version":"3.31.4"}; without that row these are dead data, because nothing fingerprinted Budibase at all. Split out of the 3.40.0 row above by its `ge`: the regression was INTRODUCED in 3.39.4, so on anything older the id does not apply and folding it into the lt-3.40.0 group would have claimed it on this very test target (3.31.4). Same fix train, different affected floor - which is exactly the case a `ge` exists for. Version-match only. Every id here is either authenticated-builder-level or reachable only by mutating somebody's application data (SQL injection into their datasource, an arbitrary file write, a tenant-owner email change), so none can be confirmed in-band without doing the damage the finding warns about.