CVE-2026-73617 in Budibase
Summary
by MITRE • 08/13/2026
Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass per-user access controls, read arbitrary documents, execute JavaScript via $where operators, or modify collections through update and delete operations.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability exists within Budibase's MongoDB datasource integration prior to version 3.40.0 and represents a critical NoSQL injection flaw that undermines the application's data security model. The vulnerability stems from improper handling of user-supplied parameters where the system employs handlebars templating with noEscaping: true configuration, which allows direct insertion of user input without proper sanitization or validation. This design choice creates an exploitable path where attackers can inject MongoDB operators directly into query parameters, bypassing the intended per-user access controls that should govern data access permissions.
The technical implementation flaw occurs when the system processes user inputs through a templating engine without adequate operator filtering or parameter validation. When handlebars is configured with noEscaping: true, it renders user input verbatim without escaping special characters or operators that have semantic meaning in MongoDB query syntax. This creates a direct injection vector where attackers can manipulate database operations by injecting MongoDB operators such as $where, $or, $and, $gt, $lt, and other query modifiers directly into the parameterized queries. The absence of operator filtering means that these malicious operators are not only accepted but executed within the database context, allowing for full exploitation of the vulnerability.
The operational impact of this vulnerability is severe and multifaceted, potentially enabling attackers to perform unauthorized data access, modification, and deletion operations across the MongoDB collections. Through this injection vector, attackers can bypass per-user access controls and read arbitrary documents from any collection within the database, regardless of the user's intended permissions. The $where operator specifically allows for JavaScript execution within the database context, providing attackers with the capability to perform complex data manipulation operations or even execute arbitrary code on the database server itself. Additionally, attackers can leverage update and delete operations to modify or destroy critical data, potentially causing complete data loss or corruption that could affect business operations and compliance requirements.
This vulnerability aligns with CWE-94, which describes the injection of untrusted data into a command or query, and specifically maps to ATT&CK technique T1213.002 for Data from Databases where attackers attempt to access database resources through injection attacks. The flaw also demonstrates characteristics of privilege escalation through insecure input handling and represents a failure in the principle of least privilege enforcement within the application's security architecture. Organizations using affected versions should immediately implement mitigation strategies including updating to Budibase 3.40.0 or later, implementing proper parameter validation and sanitization for all user-supplied inputs, and configuring appropriate operator filtering mechanisms to prevent MongoDB operator injection. Additionally, network segmentation, database access controls, and monitoring of unusual query patterns should be implemented as additional defensive measures to reduce the attack surface and detect potential exploitation attempts.
The vulnerability highlights critical gaps in secure coding practices within the application's data handling pipeline, particularly around template processing and input validation for database operations. Security teams should conduct comprehensive assessments of all MongoDB integrations within their applications to identify similar injection vulnerabilities that may exist in other components or third-party integrations. Regular security testing including automated scanning for injection vulnerabilities and manual code reviews focused on database interaction patterns should be implemented as part of the overall security posture to prevent similar issues from emerging in future releases or modifications to existing systems.