Budibase Vulnerability Allows Bypass and Information Disclosure

CERT-Bund has released security advisory WID-SEC-2026-0776 detailing a critical vulnerability (CVSS Base Score 8.7) in the Budibase open-source low-code platform. Versions up to and including 3.30.6 are affected. The vulnerability allows a remote, authenticated attacker to bypass security controls and potentially disclose sensitive information.

Organizations utilizing Budibase versions prior to 3.30.6 should immediately update to a patched version or implement available mitigations. Failure to address this vulnerability could lead to unauthorized information disclosure and compromise of internal applications built on the platform. While no specific compliance deadline is mentioned, prompt action is recommended to prevent exploitation.