CVE-2026-45717 Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL
Authenticated users can overwrite datasource configurations due to missing builder checks, enabling internal service probing and credential theft.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45717?
CVE-2026-45717 is a high-severity missing authorization vulnerability in budibase, published on 27 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Budibase is an open-source low-code platform. Prior to 3.38.1, Budibase exposes a REST API for datasource management. The route PUT /api/datasources/:datasourceId is registered in the authorizedRoutes group with TABLE/READ permission. This is the same authorization level as the read endpoint (GET /api/datasources/:datasourceId). Every authenticated Budibase app user with the BASIC built-in role or higher carries TABLE/WRITE (and therefore TABLE/READ) permissions, and the datasource update controller performs no additional builder check. As a result, any authenticated non-builder app user can submit a PUT request to rewrite a datasource's config object — including the connection host, port, database credentials, or the base url of a REST datasource. Because no network-level SSRF protection is applied to SQL driver connections, redirecting a PostgreSQL/MySQL/MongoDB datasource to an internal IP address succeeds and the attacker can probe or interact with internal services on arbitrary ports. This vulnerability is fixed in 3.38.1.
Weakness: CWE-862
Which versions are affected by CVE-2026-45717?
2 open source packages ship an affected version, including @budibase/server.
| Package | Affected | Fixed in |
|---|---|---|
@budibase/server npm | All versions | 3.38.1 |
@budibase/server npm | All versions | 3.38.1 |
How do I fix CVE-2026-45717?
Upgrade @budibase/server to 3.38.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-45717 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45717 exists.
Sources
Also known as GHSA-44m2-crh7-f4q2.