CVE-2026-41428

The middleware responsible for authentication uses unanchored regular expressions to match patterns of public endpoints against the full URL of the request. In the Koa framework, the ctx.request.url field also contains the query string, which means the regular expression matches not only the proper path but also part of the query parameters. An attacker can therefore send a request to a protected endpoint (e.g. POST /api/global/users/search) and include a public path in the query string (e.g. ?x=/api/system/status), which causes a false match by the regular expression and bypasses the entire identity verification.

An attacker without any privileges can gain access to any protected API endpoint, leading to unauthorized reading of sensitive data and potential system disruption (according to CVSS vector: high impact on confidentiality and availability).

Budibase should be updated to version 3.35.4 or later, in which the vulnerability was fixed by properly anchoring the regular expressions used in the authentication middleware.

Budibase in versions earlier than 3.35.4