CVE-2026-72853 in Budibase
Summary
by MITRE • 08/14/2026
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability exists within Budibase's Oracle datasource connector where insufficient input validation and sanitization allows for SQL injection attacks through improperly escaped table names containing double quotes. The flaw specifically manifests during post-write row lookup operations when the system fails to properly escape identifiers, creating a pathway for malicious actors to execute arbitrary database commands under the privileges of the datasource user account.
The technical implementation of this vulnerability stems from CWE-89 which defines SQL injection as the insertion of malicious SQL code into input fields that are then processed by the database engine. In this case, the Oracle connector does not adequately sanitize table names that contain double-quote characters, allowing attackers to inject additional SQL commands that execute with the same privileges as the datasource connection. This represents a critical authorization bypass vulnerability since the attacker only needs write permissions on a target table to exploit this flaw.
Operational impact of this vulnerability extends beyond simple data theft as it enables full read and write access to the database through the compromised datasource connection. An attacker could extract sensitive information, modify critical business data, or even escalate privileges within the database environment. The vulnerability is particularly dangerous because it requires minimal prerequisites - only write permissions on a table with a double-quote in its name allows an attacker to execute arbitrary SQL commands against the entire database schema accessible through that datasource.
The attack vector typically involves creating or modifying a table name containing double quotes, then leveraging the post-write lookup functionality to trigger the injection. This aligns with ATT&CK technique T1078 which covers valid accounts and T1213 which covers data from information repositories. Organizations using Budibase versions prior to 3.40.0 face significant risk as this vulnerability can be exploited remotely without requiring elevated privileges beyond basic write access.
Mitigation strategies include immediate upgrade to Budibase version 3.40.0 or later where proper input sanitization has been implemented. Additional protective measures involve implementing strict database user permissions, limiting datasource connection privileges to only necessary operations, and conducting thorough input validation on all table and column names. Database administrators should also monitor for unusual query patterns and implement network-level protections such as firewalls that restrict direct database access from application servers where possible.