CVE-2026-100688

Executive Summary

CVE-2026-100688 is a cross-tenant information disclosure vulnerability in the Budibase low-code platform affecting server versions prior to 3.45.0. An authenticated user can abuse the GET /api/applications/:appId/appPackage endpoint to retrieve another tenant's application metadata and source code — including navigation structure, role names, internal screen URLs, JavaScript snippets, and user identifiers — because the endpoint performs no authorization check binding the requested appId to the caller's tenant membership. With a CVSS base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the flaw requires only low-privileged authenticated access and yields a high confidentiality impact, making any multi-tenant Budibase deployment exposed to untrusted or semi-trusted authenticated users a priority investigation target.

Technical Analysis

The vulnerability is an instance of CWE-639 (Authorization Bypass Through User-Controlled Key), commonly described as an Insecure Direct Object Reference (IDOR) affecting a tenant-scoped object. The affected resource is the application package served by the endpoint GET /api/applications/:appId/appPackage. The :appId path segment is a user-controlled key that selects which application package the server returns.

The core defect is the absence of an authorization check that would otherwise verify that the authenticated principal is a member of — or otherwise entitled to access — the tenant that owns the referenced application. The NVD description states plainly that the endpoint allows "authenticated users to read another tenant's application metadata and source code" and that attackers "can supply a victim tenant's app id to retrieve sensitive application details" "without authorization checks." This indicates the server resolves and serializes the application package based solely on the client-supplied appId, with authentication enforced (a valid session/token is required) but object-level authorization omitted.

The data exposed by the endpoint is the assembled application package. Per the description this includes:

• navigation structure,
• role names,
• internal screen URLs,
• JavaScript snippets,
• user identifiers.

These artifacts are the application's design and business-logic layer. Because Budibase is a low-code platform, the leaked package can reveal automation logic, data-binding behavior, internal routing, the application's role/authorization model (role names), and identifiers of users within the victim tenant. That combination materially reduces the reconnaissance effort required for follow-on attacks against the victim tenant and can expose embedded logic or identifiers that were never intended to cross tenant boundaries.

No public proof-of-concept, exploit code, or Nuclei template was available at the time of analysis. The vulnerability class (IDOR/user-controlled key on a tenant-scoped identifier) is well understood, but no CVE-specific exploit artifacts exist in the provided data, so the mechanics below are described at the vulnerability-class level rather than as a verified exploit chain.

Affected component: Budibase server, all versions before 3.45.0 (as stated in the NVD description). OSV package mapping and an explicit affected-version list were not available from tracked sources.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-639, IDOR via user-controlled key) and the endpoint behavior described in the NVD entry. Do not treat the steps as verified against a live target.

1. Reconnaissance / target identification. The attacker identifies a multi-tenant Budibase deployment. Because the endpoint is part of the Budibase server API, any reachable Budibase instance hosting more than one tenant is a candidate. The attacker obtains a valid low-privileged authenticated account in their own tenant — this satisfies the PR:L precondition and establishes a legitimate session.

2. Triggering the flaw class. The attacker issues a request to GET /api/applications/:appId/appPackage, substituting an appId belonging to a victim tenant rather than one from their own tenant. Crucially, the request is authenticated (the attacker's own valid session), so it passes authentication. The server returns the application package for the supplied appId because it fails to verify that the appId is within the caller's tenant scope — the definition of CWE-639.

3. Payload / execution method. No code execution, injection payload, or malformed input is required. The "payload" is simply a cross-tenant appId placed in the path of an otherwise well-formed, authenticated GET request. Iterating or guessing valid appId values (or harvesting them from any other observable source) increases coverage. The attack is a single read request per target application.

4. Post-exploitation impact. For each successfully retrieved package, the attacker obtains the victim tenant's navigation structure, role names, internal screen URLs, JavaScript snippets, and user identifiers. This is high-value reconnaissance: role names and screen URLs map the victim's authorization model and application surface; JavaScript snippets expose business logic; user identifiers enable subsequent targeting, social engineering, or correlation with other datasets. The attacker remains a read-only observer — there is no integrity or availability impact per the CVSS vector.

Impact Assessment

The CVSS 3.1 base vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, yielding a base score of 6.5 (Medium). Subscores:

• Attack Vector (AV:N): the endpoint is network-reachable over HTTP(S).
• Attack Complexity (AC:L): exploitation requires no special conditions — only a valid session and a target appId.
• Privileges Required (PR:L): any authenticated user, including a low-privileged account in an unrelated tenant, satisfies the precondition.
• User Interaction (UI:N): no victim interaction is required.
• Scope (S:U): impact is confined to the same security authority (the Budibase server).
• Confidentiality (C:H): the exposure of application source code, navigation, role names, internal screen URLs, JavaScript snippets, and user identifiers constitutes a serious loss of confidentiality.
• Integrity (I:N) and Availability (A:N): no modification or disruption.

Business impact: for platform-as-a-service providers, MSPs, and enterprises running Budibase multi-tenant, this is a tenant-isolation failure. Tenant isolation is a contractual and often regulatory expectation; source-code and configuration leakage can expose proprietary logic, internal URL structures, and customer/user identifiers. The leaked user identifiers and role names directly aid lateral targeting, privilege-model mapping, and phishing. Blast radius scales with the number of tenants hosted on a single instance: one authenticated foothold anywhere on the platform can potentially enumerate the application packages of every tenant. Because exploits are trivial read requests, exposure may leave minimal conventional exploit telemetry, complicating post-incident attribution.

Detection Guidance

Detection focuses on anomalous access to the /api/applications/:appId/appPackage endpoint, especially requests where the requested appId does not correspond to the caller's own tenant/application set. The strongest signal is a single authenticated session requesting application packages across many distinct appId values in a short window.

Sigma Rule

title: Budibase Cross-Tenant Application Package Access (CVE-2026-100688)
id: 8f4c1b2e-0a7d-4c3e-9b21-7d5e6a9c0f13
status: experimental
description: Detects access to the Budibase appPackage endpoint consistent with cross-tenant IDOR exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100688
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-method: 'GET'
    cs-uri-stem|contains: '/api/applications/'
    cs-uri-stem|endswith: '/appPackage'
  selection_status:
    sc-status: 200
  condition: selection_endpoint and selection_status
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate users repeatedly loading their own application packages
  - Health checks or automation that target a single, known appId
level: medium
tags:
  - attack.t1213
  - cve.2026-100688

YARA Rule

rule CVE_2026_100688_Budibase_AppPackage_Access
{
    meta:
        description = "Detects Budibase appPackage cross-tenant access attempts in HTTP request/response artifacts and logs"
        cve = "CVE-2026-100688"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100688"

    strings:
        $endpoint = "/api/applications/" ascii wide
        $suffix   = "/appPackage" ascii wide
        $method   = "GET /api/applications/" ascii wide

    condition:
        filesize < 5MB and
        (($method and $suffix) or ($endpoint and $suffix))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100688 Budibase Cross-Tenant appPackage Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/applications/"; http.uri; content:"/appPackage"; distance:0; fast_pattern; classtype:attempted-recon; reference:cve,2026-100688; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100688; sid:2026100688; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [http where http.request.method == "GET" and
         http.request.path : "/api/applications/*/appPackage"]

Splunk SPL Query

index=web OR index=proxy
| eval uri = coalesce(uri, url, cs_uri_stem)
| where match(uri, "(?i)^/api/applications/[^/]+/appPackage")
| rex field=uri "^/api/applications/(?<app_id>[^/]+)/appPackage"
| bin _time span=5m
| stats dc(app_id) as distinct_apps values(app_id) as app_ids by src_ip, user, _time
| where distinct_apps >= 3
| table _time, src_ip, user, distinct_apps, app_ids

Wazuh OSSEC Rule

<group name="budibase,web,cve-2026-100688,">
  <rule id="100688" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/api/applications/</field>
    <field name="url">/appPackage</field>
    <field name="method">GET</field>
    <description>CVE-2026-100688: Budibase appPackage endpoint accessed - possible cross-tenant IDOR attempt</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description references Budibase server 3.45.0 as the version that resolves the issue ("before 3.45.0"), but no vendor advisory, commit, or patch artifact was available from tracked sources; validate against the vendor before relying on it.

1. Immediate mitigations:

   • Restrict network access to the Budibase server API so that only trusted networks or authenticated users who legitimately require multi-tenant access can reach /api/applications/:appId/appPackage.
   • Apply an authorization layer at the reverse proxy / API gateway that enforces the caller's tenant binding — reject requests where the :appId does not belong to the authenticated principal's tenant, if the mapping is externally enforceable.
   • Audit deployments for cross-tenant hosting. Where feasible, split tenants onto separate instances so a single authenticated account cannot reference another tenant's appId.
   • Reduce the population of low-privileged accounts and tightly control who can self-register on exposed instances.

2. Patch / upgrade steps:

   • Upgrade Budibase server to 3.45.0 or later, per the version stated in the NVD description. Because patch confidence is 0/4, verify the fix through the vendor's release notes and confirm the endpoint enforces tenant-scoped authorization after upgrade.
   • Test in a staging environment that an authenticated user in tenant A can no longer retrieve tenant B's package.

3. Long-term hardening:

   • Enforce object-level authorization on every tenant-scoped API endpoint — never trust a client-supplied object key to determine tenant scope; bind it to the authenticated session.
   • Adopt tenant-context middleware that rejects or strips cross-tenant identifiers by default.
   • Log and alert on cross-tenant access patterns (see Detection Guidance) and review user identifier exposure in API responses.
   • Include IDOR/user-controlled-key test cases in regression testing and pre-release security reviews.

References

• NVD — CVE-2026-100688: https://nvd.nist.gov/vuln/detail/CVE-2026-100688
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK — T1213 Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Budibase project / release notes (verify version 3.45.0 fix status): https://github.com/Budibase/budibase

No public PoC, exploit code, or Nuclei template was available at the time of analysis, and there is no evidence of exploitation in the wild or CISA KEV listing. EPSS has not yet been scored by FIRST.org. No threat actor campaigns can be attributed based on the data provided.