CVE-2026-45717: Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL.

Synopsis

An authorization bypass in Budibase allows any authenticated app user to overwrite datasource connection parameters via the PUT /api/datasources/:datasourceId endpoint, which is incorrectly protected by TABLE/READ permission rather than builder-level access. The vulnerability is reachable over the network with a low-privilege account and requires no victim interaction. Successful exploitation gives an attacker full read, write, and denial-of-service capability over affected datasources, plus the ability to redirect database connections to internal network addresses for server-side request forgery (SSRF). HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the Budibase API service via HTTP/HTTPS.

• AuthenticationRequired

  Any low-privilege Budibase account with the BASIC built-in role or higher is sufficient; no admin or builder credentials are needed.

• Victim interactionNot required

  The attacker sends a direct PUT request to the API; no action from another user is required.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: the attacker constructs a valid PUT request body with attacker-controlled connection parameters, and the server applies the change without additional checks.

Blast Radius

• Reads database credentials stored in or derivable from overwritten datasource configs, exposing usernames, passwords, and connection strings.
• Modifies datasource connection targets to redirect SQL or REST driver connections to attacker-controlled hosts, enabling credential harvesting and data interception.
• Probes or interacts with internal services on arbitrary ports by pointing datasource hosts to internal IP addresses, effectively using the Budibase server as an SSRF pivot.
• Disrupts application functionality by overwriting connection parameters with invalid values, causing the affected datasource and any dependent apps to fail.