CVE-2026-82244

COMPONENT VERSION RANGE

NewScan fingerprints Budibase from its response and reports this CVE when the detected version falls inside the affected range below.

MEASURED 2026-08-28 against vulhub/budibase 3.31.4 (training/cve budibase-idor), the same target the 2026-08-14 batch was measured on. The version arrives from the tech_signatures "Budibase" version_from on /api/system/status, which answers anonymously with {"health":{"passing":true},"version":"3.31.4"}. ONE ROW PER FIX BOUNDARY, the convention the 2026-08-14 rows below set: all seven ids here name 3.41.3 as their only fixed version, so they are one train and one finding - unlike that batch, which spanned four. CVE-2026-82244 (9.4) is the reason this row is critical: plugin handling evaluates an uploaded plugin's code, so an authenticated admin reaches arbitrary execution on the server. CVE-2026-82239 (8.6) skips per-table role restrictions on POST /api/datasources/query, letting a BASIC user read and write tables the app's roles deny them; CVE-2026-82240 (8.6) fails to validate app-scoped builder role assignments in the public user create/update endpoints, so an app-scoped builder grants itself builder rights elsewhere; CVE-2026-82242 (8.3) is missing authorization on POST /api/resources/duplicate, injecting tables and automations across applications; CVE-2026-82243 (8.3) is SSRF with credential leakage in the datasource verify endpoint; CVE-2026-82246 (7.1) is SSRF in the query import endpoint, which fetches a user-supplied URL unvalidated; CVE-2026-82245 (7.2) leaves licence-management endpoints unauthorized, so any authenticated user can delete licence keys. VERSION-MATCH ONLY, for the reason the row below states and this batch does not change: every id is authenticated-builder-or-admin level or requires mutating somebody's application data, so an in-band confirmation would be the damage the finding warns about. CVE-2026-82241 shares this fix version and is a SEPARATE row because its affected floor differs - see it below.