CVE-2026-73618

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON structural characters to alter MongoDB queries, bypassing filters to read, modify, or delete arbitrary documents.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/Budibase/budibase/security/advisories/GHSA-qw6m-8fw2-2v64
https://www.vulncheck.com/advisories/budibase-server-before-nosql-injection-via-json-parameter
https://github.com/Budibase/budibase/security/advisories/GHSA-qw6m-8fw2-2v64

Configurations

No configuration.

History

23 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Budibase servidor anterior a 3.40.0 contiene una vulnerabilidad de inyección NoSQL en el punto final de ejecución de consultas de MongoDB donde los parámetros proporcionados por el usuario se interpolan en plantillas de consulta JSON sin la sanitización adecuada de los metacaracteres JSON. Los atacantes con permiso de escritura de consultas pueden inyectar caracteres estructurales JSON para alterar las consultas de MongoDB, eludiendo filtros para leer, modificar o eliminar documentos arbitrarios.

Information

Published : 2026-08-13 12:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-73618

Mitre link : CVE-2026-73618

CVE.ORG link : CVE-2026-73618

JSON object : View

Products Affected

No product.

CWE

CWE-943

Improper Neutralization of Special Elements in Data Query Logic

{"id": "CVE-2026-73618", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73618", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-13T12:54:44.916968Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "budibase", "product": "server", "versions": [{"status": "affected", "version": "0", "lessThan": "3.40.0", "versionType": "semver"}, {"status": "unaffected", "version": "3.40.0", "versionType": "semver"}], "packageURL": "pkg:npm/%40budibase/server", "defaultStatus": "unaffected"}]}], "published": "2026-08-13T12:17:26.770", "references": [{"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-qw6m-8fw2-2v64", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/budibase-server-before-nosql-injection-via-json-parameter", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-qw6m-8fw2-2v64", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-943"}]}], "descriptions": [{"lang": "en", "value": "Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON structural characters to alter MongoDB queries, bypassing filters to read, modify, or delete arbitrary documents."}, {"lang": "es", "value": "Budibase servidor anterior a 3.40.0 contiene una vulnerabilidad de inyecci\u00f3n NoSQL en el punto final de ejecuci\u00f3n de consultas de MongoDB donde los par\u00e1metros proporcionados por el usuario se interpolan en plantillas de consulta JSON sin la sanitizaci\u00f3n adecuada de los metacaracteres JSON. Los atacantes con permiso de escritura de consultas pueden inyectar caracteres estructurales JSON para alterar las consultas de MongoDB, eludiendo filtros para leer, modificar o eliminar documentos arbitrarios."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "disclosure@vulncheck.com"}