01 Record

CVE-2026-72851

Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook

CriticalPUBLISHEDCNA: VulnCheck

Base score9.0 CVSS v4.0CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

02 Description

Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook

Published: 2026-08-13 21:54Z20 HR AGO
Last updated: 2026-08-13 21:54Z20 HR AGO
Reserved: 2026-08-10
Assigning CNA: VulnCheck
Record state: PUBLISHED
Severity: Critical (CVSS 9.0)
CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weaknesses: CWE-89
SSVC decision: No CISA-ADP assessment
Data version: 5.2
Document digest: 6b8dc22deff23b9cad4a9635289abe28947056d9534cf26ca7ffd4083b1209f4

VendorProductVersionsPlatforms

budibaseserver0 to < 3.40.0—

github.comGitHub Security Advisory (GHSA-x7h8-ww3q-xv7c)https://github.com/Budibase/budibase/security/advisories/GHSA-x7h8-ww3q-xv7cvendor-advisory
www.vulncheck.comVulnCheck Advisory: Budibase before 3.40.0 SQL Injection via Unauthenticated Webhookhttps://www.vulncheck.com/advisories/budibase-before-sql-injection-via-unauthenticated-webhookthird-party-advisory