CVE-2026-82239General

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query requests with target table identifiers to bypass table-level access controls and manipulate restricted data.

0.0/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • General: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-08-28: 1Technical Details · 2026-08-28: 108-28
Signal classification1 categories
General
1100.0%
Referenced assets1 URL
Full discourse1 post
  • NewNormal Security@NewScanTeam
    General

    NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 28 Aug 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 🚨 Outdated ownCloud — WebDAV answers with no login, so a known username is enough to read or delete their files, or a leftover test file prints the admin password, as seen in ownCloud CVE-2023-49105, CVE-2023-49103 ⚡ Outdated Budibase — an uploaded plugin runs as code, and low-privilege users reach data and roles their app denies them, as seen in Budibase CVE-2026-82244, CVE-2026-82239, CVE-2026-82240, CVE-2026-82241, CVE-2026-82242, CVE-2026-82243, CVE-2026-82245, CVE-2026-82246 📦 FileBrowser with no maintainer left — a named pipe in a shared folder hangs downloads, and no fix will ever ship, as seen in FileBrowser CVE-2026-82235, CVE-2026-82237, CVE-2026-82238 Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #AuthBypass #CSO #REDTEAM

    Post summary

    The post details several recent CVEs with brief behavioral descriptions but provides no proof of concept, exploit code, or patch information.

    0000071
    6 followersView on X

Explore more