CVE-2026-100688 in Budibase
Summary
by MITRE • 09/26/2026
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrieve sensitive application details including navigation structure, role names, internal screen URLs, JavaScript snippets, and user identifiers without authorization checks.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in Budibase server versions prior to 3.45.0 represents a critical failure in multi-tenant isolation mechanisms, specifically classified under CWE-284 Improper Access Control. This flaw resides within the GET /api/applications/:appId/appPackage endpoint, which is designed to retrieve application metadata and source code for administrative or development purposes. The core technical deficiency lies in the server's inability to validate whether the authenticated user requesting the data belongs to the same tenant as the target application identified by the appId parameter. Consequently, an attacker who has obtained valid credentials for any account within the Budibase instance can manipulate this endpoint to access resources belonging to other tenants. This lack of proper authorization checks allows for a direct bypass of logical access controls that are fundamental to secure multi-tenant architecture.
From an operational perspective, the impact of this vulnerability is severe due to the richness of data exposed by the appPackage response. An attacker can retrieve comprehensive details about another tenant's application structure without needing any prior knowledge of its internal configuration. The disclosed information includes navigation structures, which reveal how users interact with the system; role names and user identifiers, which facilitate social engineering or further targeted attacks against specific individuals within the victim organization; and critical source code artifacts such as JavaScript snippets and internal screen URLs. This level of exposure effectively neutralizes the security boundary between tenants, turning a multi-tenant environment into one where data isolation is purely theoretical rather than enforced by technical controls.
The exploitation path aligns with ATT&CK techniques related to Collection and Discovery, specifically T1005 Data from Local System or T1213 Data from Information Repositories, as the attacker systematically gathers intelligence about the victim's infrastructure. By analyzing the retrieved JavaScript snippets and internal URLs, an adversary can map out the application logic, identify potential injection points in client-side code, or discover undocumented endpoints that may harbor additional vulnerabilities. The exposure of user identifiers also aids in credential stuffing attacks or phishing campaigns tailored to specific roles within the compromised tenant, thereby escalating the risk from mere information disclosure to active compromise of downstream systems and data integrity.
Mitigation for this vulnerability requires an immediate upgrade to Budibase version 3.45.0 or later, where the authorization logic has been corrected to enforce strict tenant isolation on all API endpoints handling application resources. In environments where patching is not immediately feasible, administrators should implement network-level access controls such as Web Application Firewalls (WAF) that inspect request parameters for signs of cross-tenant enumeration attempts. Additionally, it is advisable to audit existing user permissions and ensure that the principle of least privilege is strictly applied, limiting which users have access to application management endpoints until the underlying software defect is resolved. Regular security assessments focusing on logical flaws in multi-tenant applications are recommended to detect similar bypasses in other components of the platform.