A flaw in Budibase prior to version 3.39.0 allows a user with Basic app privileges to modify the base URL of a REST datasource while keeping redacted placeholders, causing the system to merge the original authentication configuration and then expose that confidential secret through an attacker-controlled listener when a relative query is executed.

The vulnerability affects all installations of Budibase built with the open-source platform, specifically those running any version older than 3.39.0. Any instance that creates a REST datasource and grants Basic app users WRITE permissions is at risk.

With a CVSS score of 8.1 the risk is high, and although the EPSS score is not available and the vulnerability is not listed in KEV, the fact that Basic app users are typically plentiful makes exploitation likely. An attacker who has or can compromise a Basic app account can change the datasource URL to point to a malicious endpoint, trigger the stored query, and receive the stored authorization headers, enabling credential exfiltration.