Budibase, an open‑source low‑code platform, has a flaw in the POST /api/tables/:sourceId/actions/:actionId/trigger endpoint that does not verify that a supplied rowId belongs to the set of rows allowed by a view’s filter. This is a permission enforcement weakness (CWE‑863). An authenticated user who can see a filtered view can trigger row actions on any row in the underlying table, including rows that the view explicitly hides, allowing the user to perform unintended actions on data they should not have access to.

All Budibase deployments running a version earlier than 3.38.1 are affected. The vulnerability occurs when a user with access to a filtered view makes a request to the row‑action endpoint, which is part of the Budibase API.

The CVSS score of 5.4 classifies this flaw as moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires only that the user be authenticated and possess permissions to a given filtered view, an attacker with legitimate credentials can exploit the flaw by sending a crafted request to the API or interacting with the web UI. The exploit does not require privilege escalation, so the risk is primarily to data integrity and unintended action execution.