A privileged‑level bug in Budibase allows any authenticated user with a BASIC or higher role to change a datasource’s connection parameters via the PUT /api/datasources/:datasourceId endpoint. The API is incorrectly secured only with TABLE/READ permissions, which do not enforce the stricter builder role, and the controller performs no extra check. An attacker can therefore point a datasource at arbitrary internal hosts, ports, or database credentials, gaining the ability to probe, read from, or potentially write to internal services without further authentication.

Budibase installations running any version prior to 3.38.1 are affected. The flaw is present on all systems where the REST API for datasource management is exposed, and any authenticated user who can execute API calls (including non‑builder users with BASIC-level access) can exploit it.

The vulnerability carries a CVSS score of 8.8, indicating a high severity. There is no documented EPSS value, and the issue is not listed in the CISA KEV catalog. Exploitation requires only that the attacker be authenticated to the application; no additional privileges are required beyond a normal user role. After authentication, the attacker sends a crafted PUT request, and because no server‑side SSRF checks exist for database drivers, the attacker can redirect the datasource to an arbitrary internal IP or port and interact directly with internal network services.