CVE-2026-73618 in Server
Summary
by MITRE • 08/13/2026
Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON structural characters to alter MongoDB queries, bypassing filters to read, modify, or delete arbitrary documents.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability exists within the Budibase Server software version 3.40.0 and earlier, presenting a critical NoSQL injection flaw in the MongoDB query execution endpoint. The technical implementation fails to properly sanitize user-supplied parameters before incorporating them into JSON query templates, creating an environment where malicious actors can exploit the lack of input validation to manipulate database operations. The vulnerability specifically targets the interpolation process where user data directly influences JSON structure without adequate escaping or sanitization of metacharacters that could alter the intended query execution.
The flaw allows attackers with query write permissions to inject JSON structural characters such as braces, brackets, and special operators that can fundamentally alter how MongoDB interprets and executes queries. This injection capability bypasses existing filters and security controls designed to protect database integrity, enabling unauthorized access to sensitive data through read operations or destructive actions including modification and deletion of arbitrary documents within the database. The vulnerability represents a direct violation of secure coding practices and demonstrates inadequate input validation mechanisms in the application's data processing pipeline.
From an operational perspective, this vulnerability poses significant risk to organizations relying on Budibase Server for their database operations, as it can lead to complete data compromise and system integrity breaches. Attackers exploiting this flaw can potentially gain unauthorized access to sensitive information stored in MongoDB databases, modify critical business data, or even delete entire collections of documents, resulting in substantial financial losses, regulatory compliance violations, and reputational damage. The impact extends beyond immediate data exposure to include potential cascading effects on dependent systems and services that rely on the compromised database integrity.
Mitigation strategies should focus on implementing proper input sanitization and validation mechanisms that escape or encode JSON metacharacters before incorporating user-supplied parameters into database queries. Organizations should upgrade to Budibase Server version 3.40.0 or later, which includes patches addressing this vulnerability through improved query parameter handling and enhanced sanitization routines. Additional protective measures include implementing proper access controls to limit query write permissions, establishing robust monitoring for unusual database query patterns, and conducting comprehensive security reviews of all database interaction endpoints. This vulnerability aligns with CWE-94, which addresses "Improper Control of Generation of Code," and corresponds to ATT&CK technique T1213.002 for "Data from Databases" as it enables unauthorized database access through manipulation of query execution parameters.