CVE-2026-82242

Executive Summary

CVE-2026-82242 is a missing authorization vulnerability in Budibase versions prior to 3.41.3, affecting the POST /api/resources/duplicate endpoint. An authenticated builder with low privileges can inject tables, automations, queries, and screens into any other application—even without holding any role in the destination workspace—by specifying an arbitrary destination workspace ID in the request body. Because injected automations can contain outgoing webhooks, attackers can exfiltrate sensitive data from victim applications. The vulnerability carries a CVSS score of 7.7 (High) and remains unpatched in all versions prior to 3.41.3; the vendor patch has not yet been independently confirmed across all tracked sources.

Technical Analysis

The core issue is an authorization bypass (CWE-862 — Missing Authorization) in the resource duplication feature of Budibase, a low-code development platform used to build internal tools, CRUD applications, and automation workflows.

The vulnerable endpoint is POST /api/resources/duplicate. In proper operation, this endpoint should verify that the requesting user has the appropriate role (e.g., builder, admin) in the destination workspace before copying resources into it. The flaw arises because this authorization check is either absent or incorrectly scoped—the endpoint trusts the workspaceId (or equivalent workspace identifier) supplied in the request body without validating that the authenticated user holds any role in that workspace.

The request body allows the caller to specify the destination workspace ID arbitrarily. The endpoint then duplicates the following resource types into that workspace:

• Tables — database schemas and stored data structures
• Automations — event-driven workflows with triggers and actions
• Queries — data retrieval operations against datasources
• Screens — front-end UI components of the application

Crucially, automations in Budibase can be configured with outgoing webhook actions. When an automation is triggered, it can send HTTP requests to arbitrary external endpoints with data from the application's context. This is the primary exfiltration primitive.

Attack surface: Any authenticated user with builder role in at least one workspace (the source) can exploit this. The privilege required is Low (PR:L), and the attack requires no user interaction (UI:N). The vulnerability is exploitable over the network (AV:N).

Root cause class: The endpoint fails to enforce a workspace-boundary authorization check. The developer likely assumed that authentication alone was sufficient for resource duplication, or relied on a helper function that only verified the user's role in the source workspace, not the destination.

Missing details: The CNA description does not specify whether the destination workspace ID is validated against any allowlist, whether constraints exist on which resource types can be injected, or whether rate limiting is applied to the endpoint. These details are unavailable in the provided data.

Exploitation Scenarios

No public PoC exists for this vulnerability. The attack chain below is inferred from the vulnerability class and the NVD description.

Step 1: Reconnaissance & Target Identification

An attacker with builder-level access to any Budibase workspace performs reconnaissance to identify:

• The Budibase instance's API base URL (typically https://<instance>/api)
• Other workspaces/applications hosted on the same instance that contain sensitive data (via API enumeration or user enumeration)
• The destination workspace IDs (often UUIDs or numeric identifiers discoverable through API responses or shared links)

Step 2: Triggering the Vulnerability

The attacker issues an authenticated HTTP POST request to POST /api/resources/duplicate with a crafted JSON body containing:

• The source resource IDs (tables, automations, queries, screens) they wish to inject
• An arbitrary workspaceId field set to the victim's workspace ID — a workspace in which the attacker holds no role

Because the endpoint fails to verify the attacker's role in the destination workspace, the request is processed successfully and the resources are copied into the victim's application.

Step 3: Payload Construction & Execution (Vulnerability-Class Level)

The attacker crafts a malicious automation resource before duplication, or modifies an existing one, to include:

• A trigger (e.g., on-row-create, scheduled, or manual invocation)
• An outgoing webhook action pointing to an attacker-controlled server (e.g., https://attacker.example/collect)

Once injected into the victim's workspace, the automation is dormant until its trigger fires. The attacker may:

• Trigger it remotely via the Budibase API if the automation exposes a trigger endpoint
• Wait for a scheduled trigger to fire
• Convince a legitimate user to interact with an injected screen, triggering the automation

Step 4: Post-Exploitation Impact

When the injected automation fires, it sends an HTTP POST request to the attacker-controlled webhook URL with data pulled from the victim's tables or query results. This achieves data exfiltration from applications the attacker was never authorized to access.

The impact is integrity-focused (C:I — High, C:C — None) because the attacker cannot directly read data in transit—but through injected automations, they can cause the victim's own instance to send data out, achieving exfiltration without direct read access. The confidentiality impact is scored None because the vulnerability itself does not expose data in the response, but the practical effect of webhook-based exfiltration violates confidentiality.

Impact Assessment

• CVSS Score: 7.7 (High) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
• Attack Vector (AV:N): Remote exploitation over the network
• Attack Complexity (AC:L): No special conditions required
• Privileges Required (PR:L): Only a low-privilege builder account is needed
• User Interaction (UI:N): Not required for exploitation
• Scope (S:C): Compromise of one workspace can affect other workspaces on the same instance, changing the security boundary
• Confidentiality (C:N): No direct data disclosure in the HTTP response
• Integrity (I:H): Full integrity compromise of target workspaces — attacker can inject arbitrary resources
• Availability (A:N): No direct denial of service

Business Impact:

• Data Breach: Exfiltration via webhooks of customer records, internal databases, or operational data stored in Budibase tables
• Automation Hijacking: Injected automations can be abused for phishing, spam relays, or further internal reconnaissance
• Multi-Tenant Compromise: In multi-tenant deployments, one compromised tenant can inject resources into all others
• Compliance Violations: Regulatory exposure (GDPR, HIPAA, PCI-DSS) if exfiltrated data includes PII or PHI

**Blast Radius: All Budibase applications on a shared instance are at risk if any single workspace has at least one malicious or compromised builder. The lack of patch data (0/4 confidence) means all versions prior to 3.41.3 remain vulnerable.

Detection Guidance

Sigma Rule

title: Budibase Unauthorized Resource Duplication - CVE-2026-82242
id: 6a7c9f7e-4b9f-4b3e-8d2f-9b4a5c6d7e8f
status: experimental
description: Detects POST requests to Budibase /api/resources/duplicate endpoint that may indicate unauthorized resource injection across workspaces.
logsource:
  category: web
  product: budibase
detection:
  selection:
    cs-method: POST
    cs-uri-path: /api/resources/duplicate
  filter_upgrade:
    cs-version: '>=3.41.3'
  condition: selection and not filter_upgrade
falsepositives:
  - Legitimate resource duplication by workspace admins
  - API clients performing routine copy operations
level: high
fields:
  - src_ip
  - cs-username
  - cs-uri-query
  - http.user_agent

YARA Rule

rule Budibase_Unauthorized_Duplicate_CVE_2026_82242
{
   meta:
      author = "Valterit Security Research"
      description = "Detect HTTP requests targeting Budibase resource duplication endpoint"
      date = "2026-01-15"
      cve = "CVE-2026-82242"
      score = 60
   strings:
      $endpoint = "/api/resources/duplicate"
      $method = "POST" ascii
      $field_workspace = "workspaceId" ascii nocase
      $field_resources = "resources" ascii nocase
   condition:
      uint16(0) == 0x0A0D or uint16(0) == 0x0D0A and
      any of them and 2 of ($field_*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-82242 - Budibase Unauthorized Resource Duplication Attempt";
    flow:established,to_server;
    http.method:"POST";
    http.uri:"/api/resources/duplicate";
    http.request_body;
    content:"workspaceId"; nocase;
    classtype:attempted-user;
    sid:202682242;
    rev:1;
    metadata:created_at 2026_01_15, updated_at 2026_01_15;
)

Elastic Detection

sequence by host.id, user.id with maxspan=5m
  [ network where process.name == "java" and destination.port == 443 ]
  [ http where
      request.method == "POST" and
      url.path == "/api/resources/duplicate" and
      request.body.text contains "workspaceId"
  ]

Splunk SPL Query

index=buda_access sourcetype=access_combined
| where method=="POST" AND uri_path="/api/resources/duplicate"
| eval system_version = version
| where system_version < "3.41.3" OR isnull(system_version)
| stats count by src_ip, user, workspace_id_dest, _time
| sort - _time
| rename src_ip as "Source IP", user as "Authenticated User", workspace_id_dest as "Destination Workspace"

Wazuh OSSEC Rule

<group name="budibase,cve-2026-82242,">
  <rule id="182242" level="10">
    <decoded_as>json</decoded_as>
    <field name="method">^POST$</field>
    <field name="uri">^/api/resources/duplicate</field>
    <description>Budibase CVE-2026-82242: Potential unauthorized resource duplication attempt to /api/resources/duplicate</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>budibase_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence has been confirmed from any tracked source. The vendor has not released an official advisory at the time of writing, and no patch version has been verified beyond the reference to version 3.41.3 in the CVE metadata.

1) Immediate Mitigations (until a verified patch is available)

• Disable builder accounts for all users who do not require them. Convert builders to viewer/editor roles where possible.
• Restrict network access to the Budibase API endpoint /api/resources/duplicate via WAF rules or reverse-proxy ACLs. Block POST /api/resources/duplicate for all users except a whitelist of trusted admin IPs.
• Review workspace membership — audit all workspaces for unexpected users and remove orphaned accounts.
• Enable webhook allowlisting if the platform supports it, to restrict outbound webhook destinations to a known domain list.
• Monitor webhook activity — review any outgoing webhook calls to unrecognized external domains.

2) Patch/Upgrade Steps

• Monitor the Budibase GitHub releases page and official advisory channels for news of a verified patch.
• When a patched version is released (expected to be 3.41.3 or later based on CVE metadata), upgrade all instances immediately.
• Test the upgrade in a staging environment first, verifying that the /api/resources/duplicate endpoint now enforces destination-workspace authorization.
• Verify functionality of existing duplication workflows post-upgrade.

3) Long-Term Hardening

• Adopt least-privilege principles: Ensure builder role is reserved for trusted administrators; grant lower roles by default.
• Segment multi-tenant instances: If feasible, run separate Budibase instances per tenant to prevent cross-workspace injection.
• Implement API audit logging: Ensure all API requests are logged with user identity, workspace, source IP, and request bodies for post-incident forensics.
• Regular security reviews: Periodically audit automations for suspicious webhook endpoints and review workspace access permissions.
• Subscribing to CVE alerts: Register for vendor security notifications to receive early patch announcements.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-82242 — Official NVD catalog entry with CVSS vector and CWE classification. (Note: This URL is the standard NVD location; if unavailable at time of access, consult CVE.org)
2. Budibase Official Website: https://www.budibase.com — Vendor site to monitor for security advisories and release notes.
3. Budibase GitHub Repository: https://github.com/Budibase/budibase — Source code repository where patches and release tags (including 3.41.3) will be published.
4. CWE-862 Reference: https://cwe.mitre.org/data/definitions/862.html — MITRE CWE definition for Missing Authorization, the underlying weakness class.
5. MITRE ATT&CK Technique T1213 (Data from Information Repositories): https://attack.mitre.org/techniques/T1213/ — Mapping for the primary post-exploitation objective (data exfiltration via injected automations).

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No known threat actor campaigns or exploit-in-the-wild activity have been documented for CVE-2026-82242 at the time of this writing. CISA KEV designation: NO. EPSS score: not yet available from FIRST.org.