CVE-2026-41428

The record

Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint by appending a public endpoint path as a query parameter. For example, POST /api/global/users/search?x=/api/system/status bypasses all authentication because the regex /api/system/status/ matches in the query string portion of the URL. This vulnerability is fixed in 3.35.4.

Affected packages

Related vulnerabilities

• GHSA-8783-3wgf-jggf Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher… Same vulnerability
• GHSA-wxq7-x3qp-vcr8 Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection… Also affects @budibase/backend-core
• CVE-2026-48147 Budibase is an open-source low-code platform. Also affects @budibase/backend-core
• CVE-2026-46424 Budibase is an open-source low-code platform. Also affects @budibase/backend-core
• GHSA-6vp2-6r7m-2jvx Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users… Also affects @budibase/backend-core
• CVE-2026-42239 Budibase is an open-source low-code platform. Also affects @budibase/backend-core
• GHSA-4f9j-vr4p-642r Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full… Also affects @budibase/backend-core
• GHSA-7r9j-r86q-7g45 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist Also affects @budibase/backend-core