The vulnerability originates from unanchored regular expressions generated in the Budibase backend core when compiling route patterns. These expressions are tested against the full request URL, including the query string, allowing an attacker to inject a public route pattern that causes the CSRF middleware to skip token validation for any Worker API endpoint. As a result, an unauthenticated attacker can send state‑changing requests such as admin invites, configuration changes, and user management actions without providing a CSRF token. The CVSS score of 6.5 indicates a moderate severity, reflecting the potential for elevated privileges without authentication.

Budibase products prior to version 3.35.4 are affected. The issue is present in the backend core matchers used by the Budibase Worker.

The risk is moderate, as reflected by the CVSS score, and exploitation requires only that an attacker can craft a request to a Worker API endpoint reachable from the internet. No authentication or privileged access is required—any remote attacker can construct a query string that includes a public route pattern to trigger the bypass. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known mass exploitation. However, the nature of the flaw allows an attacker to execute privileged actions on the target system without CSRF protection, which constitutes a clear privilege escalation vector.