CVE-2026-48151— Budibase 安全漏洞
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing Application新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-48151の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema
ソース: CVE Program / CVE List V5
脆弱性説明
Budibase is an open-source low-code platform. Prior to 3.39.0, the webhook schema-building endpoint is registered under builderRoutes, but the generic authorization middleware skips authorization for all paths matching /api/webhooks/schema. As a result, an unauthenticated caller can update the body schema for a known webhook and mutate the corresponding automation trigger output schema. This vulnerability is fixed in 3.39.0.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
ソース: CVE Program / CVE List V5
脆弱性タイプ
授权机制缺失
ソース: CVE Program / CVE List V5
脆弱性タイトル
Budibase 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Budibase是英国Budibase开源的一个用于在几分钟内创建内部应用程序、工作流和管理面板的低代码平台。 Budibase 3.39.0之前版本存在安全漏洞，该漏洞源于webhook模式构建端点注册在builderRoutes下但授权中间件跳过所有匹配/api/webhooks/schema的路径，可能导致未经身份验证的调用者更新webhook模式。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-48151の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POC検証済み環境 プレミアム
Qwen3.6-35B-A3B · 4797 文字数
Pro+限定の内容：
脆弱性再現の録画（実際のサンドボックス構築 + トリガー、限定）
脆弱性の原理を深く分析
トリガー条件と影響範囲
完全な実行可能POCコード
攻撃チェーンと緩和策の提案
POCパッケージのダウンロード
月間100件以上のAI生成枠
III. CVE-2026-48151のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-48151 厂商安全公告 (1)
Same Patch Batch · Budibase · 2026-05-27 · 20 CVEs total
| CVE-2026-46425 | 9.9 CRITICAL | Budibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant users |
| CVE-2026-48150 | 9.0 CRITICAL | Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assi |
| CVE-2026-45716 | 8.8 HIGH | Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Con |
| CVE-2026-45717 | 8.8 HIGH | Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permissio |
| CVE-2026-48153 | 8.5 HIGH | Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata |
| CVE-2026-48149 | 8.1 HIGH | Budibase: Stored XSS in Text component: BASIC users execute JS in admin session via Markdo |
| CVE-2026-48152 | 8.1 HIGH | Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasour |
| CVE-2026-46427 | 7.7 HIGH | Budibase: Snowflake private key returned unmasked from datasource API to BASIC users |
| CVE-2026-45061 | 7.7 HIGH | Budibase: SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`) |
| CVE-2026-48146 | 7.7 HIGH | Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection |
| CVE-2026-45548 | 7.7 HIGH | Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation |
| CVE-2026-45715 | 7.7 HIGH | Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration |
| CVE-2026-46426 | 7.6 HIGH | Budibase: Unrestricted Upload of File with Dangerous Type |
| CVE-2026-48147 | 6.5 MEDIUM | Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection |
| CVE-2026-45719 | 6.5 MEDIUM | Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API |
| CVE-2026-45718 | 5.4 MEDIUM | Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on |
| CVE-2026-46424 | 4.2 MEDIUM | Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users |
| CVE-2026-48128 | Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step | |
| CVE-2026-48148 | Budibase: Unvalidated VectorDB Host Parameter Enables SSRF |
IV. 関連脆弱性
同じ製品: budibase
- CVE-2026-67311
Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redire - CVE-2026-54351
Budibase: Mass Assignment in Webhook Trigger Allows Cross-Wo - CVE-2026-54353
Budibase: Potential SSRF DNS rebinding bypass in outbound fe - CVE-2026-54350
Budibase: Anonymous NoSQL operator injection via published-a - CVE-2026-50137
Budibase: POST /api/attachments/:datasourceId/url is unauthe
同じベンダー: Budibase
- CVE-2026-67311
Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redire - CVE-2026-54351
Budibase: Mass Assignment in Webhook Trigger Allows Cross-Wo - CVE-2026-54353
Budibase: Potential SSRF DNS rebinding bypass in outbound fe - CVE-2026-54350
Budibase: Anonymous NoSQL operator injection via published-a - CVE-2026-50137
Budibase: POST /api/attachments/:datasourceId/url is unauthe
同じ弱点: CWE-862
- CVE-2026-67344
ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE - CVE-2026-17580
Advanced Views <= 3.9.1 - Missing Authorization to Authentic - CVE-2026-11995
Gutena Forms – Contact Form, Survey Form, Feedback Form, Boo - CVE-2026-10782
RealHomes Memberships <= 3.0.9 - Missing Authorization to Au - CVE-2026-3141
FormGent <= 1.9.2- Missing Authorization to Unauthenticated
V. CVE-2026-48151へのコメント
まだコメントはありません