Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. Attackers can inject resources by specifying an arbitrary destination workspace ID in the request body, then trigger injected automations with outgoing webhooks to exfiltrate data from victim applications.

Budibase versions prior to 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint. Authenticated builders can inject tables, automations, queries, and screens into any application without holding any role in the destination workspace. The attack is carried out by specifying an arbitrary destination workspace ID in the request body. Once resources are injected, attackers can trigger injected automations with outgoing webhooks to exfiltrate data from victim applications. This represents a significant privilege escalation and data exfiltration risk in multi-tenant Budibase environments. The vulnerability requires authentication as a builder but no further authorization checks are enforced on the destination workspace. Organizations using Budibase should upgrade to version 3.41.3 or later immediately.