CVE-2026-100688 budibase CVE debrief

Who should care

Budibase server administrators and users who rely on the affected endpoint for application metadata and source code should verify their server versions and restrict access to the endpoint.

Why it matters

Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability that allows authenticated users to read another tenant's application metadata and source code.

• Authenticated users can access sensitive application details without authorization checks.
• Victim tenant's application metadata and source code can be retrieved by supplying a victim tenant's app id.
• Defenders should verify Budibase server versions and restrict access to the affected endpoint.

Technical summary

The Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint. This allows authenticated users to read another tenant's application metadata and source code by supplying a victim tenant's app id. The vulnerability impacts Budibase server administrators and users who rely on the affected endpoint for application metadata and source code. They should verify their server versions and restrict access to the endpoint. The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories.

Defensive priority

Defenders should prioritize verifying Budibase server versions and restricting access to the affected endpoint.

Recommended defensive actions

• Verify Budibase server version and upgrade to 3.45.0 or later
• Restrict access to the GET /api/applications/:appId/appPackage endpoint
• Monitor for suspicious activity on the affected endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories. The Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint. This allows authenticated users to read another tenant's application metadata and source code by supplying a victim tenant's app id. The evidence is based on the CVE record and source item, which provide details on the vulnerability,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.