CVE-2026-73302

COMPONENT VERSION RANGE

NewScan fingerprints Budibase from its response and reports this CVE when the detected version falls inside the affected range below.

MEASURED 2026-08-14 against vulhub/budibase 3.31.4 (training/cve budibase-idor). The version arrives from the tech_signatures "Budibase" version_from on /api/system/status, which answers anonymously with {"health":{"passing":true},"version":"3.31.4"}; without that row these are dead data, because nothing fingerprinted Budibase at all. The OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without consulting getEmailVerified, so an identity provider that will issue a token for an unverified address lets an attacker land on an existing account. Its own boundary (3.39.30), not the 3.40.0 group, so a 3.39.31 install is never told it has this. Version-match only. Every id here is either authenticated-builder-level or reachable only by mutating somebody's application data (SQL injection into their datasource, an arbitrary file write, a tenant-owner email change), so none can be confirmed in-band without doing the damage the finding warns about.