CVE-2026-73618 | BDVDB-2026-359130 Detail
budibaseserver
Description#
Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON structural characters to alter MongoDB queries, bypassing filters to read, modify, or delete arbitrary documents.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact low. Attack vector: network.
Weaknesses#
- CWE-943 Improper Neutralization of Special Elements in Data Query Logic
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.