CVE-2026-73618

Published: Ago 13, 2026 Last Modified: Ago 13, 2026

ExploitDB:

Other exploit source:

Google Dorks:

HIGH 8,7

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: low

User Interaction: none

Confidentiality: N/A

Integrity: N/A

Availability: N/A

HIGH 8,3

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: low

User Interaction: none

Scope: unchanged

Confidentiality: high

Integrity: high

Availability: low

Description

AI Translation Available

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON structural characters to alter MongoDB queries, bypassing filters to read, modify, or delete arbitrary documents.

943

Improper Neutralization of Special Elements in Data Query Logic

Incomplete

Abstraction: Class Structure: Simple

Common Consequences

Security Scopes Affected:

Confidentiality Integrity Availability Access Control

Potential Impacts:

Bypass Protection Mechanism Read Application Data Modify Application Data Varies By Context

Applicable Platforms

All platforms may be affected

View CWE Details

https://github.com/Budibase/budibase/security/advisories/GH…

https://github.com/Budibase/budibase/security/advisories/GHSA-qw6m-8fw2-2v64