CVE-2026-73408

COMPONENT VERSION RANGE

NewScan fingerprints Budibase from its response and reports this CVE when the detected version falls inside the affected range below.

MEASURED 2026-08-14 against vulhub/budibase 3.31.4 (training/cve budibase-idor). The version arrives from the tech_signatures "Budibase" version_from on /api/system/status, which answers anonymously with {"health":{"passing":true},"version":"3.31.4"}; without that row these are dead data, because nothing fingerprinted Budibase at all. packages/server/src/integrations/mysql.ts turned on multipleStatements and inserted an unescaped tableName into a DESCRIBE, so one injected identifier carries a second statement. Its own boundary (3.39.18) - the oldest of the four trains. Version-match only. Every id here is either authenticated-builder-level or reachable only by mutating somebody's application data (SQL injection into their datasource, an arbitrary file write, a tenant-owner email change), so none can be confirmed in-band without doing the damage the finding warns about.