CVE-2026-73617

HIGH 7.1

Budibase before 3.40.0 NoSQL Injection via MongoDB datasource

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass per-user access controls, read arbitrary documents, execute JavaScript via $where operators, or modify collections through update and delete operations.

CWE	CWE-943
Vendor	budibase
Product	server
Published	Aug 13, 2026

Stay Ahead of the Next One

Get instant alerts for budibase server

Be the first to know when new high vulnerabilities affecting budibase server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Affected Versions

budibase / server

0 < 3.40.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Budibase/budibase/security/advisories/GHSA-pmpg-2mxq-6xwr vulncheck.com: https://www.vulncheck.com/advisories/budibase-before-nosql-injection-via-mongodb-datasource

Credits

🔍 adrgs aisafe-bot