Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. Attackers can inject resources by specifying an arbitrary destination workspace ID in the request body, then trigger injected automations with outgoing webhooks to exfiltrate data from victim applications.

Budibase versions prior to 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint. Authenticated builders can inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. The attack is performed by specifying an arbitrary destination workspace ID in the request body. Once injected, attackers can trigger malicious automations with outgoing webhooks to exfiltrate data from victim applications. This represents a significant privilege escalation and data exfiltration risk in multi-tenant Budibase deployments. The vulnerability has been patched in version 3.41.3 and is tracked as CVE-2026-82242.