The vulnerability is a NoSQL injection flaw in Budibase Server’s MongoDB query execution endpoint, where user‑supplied parameters are directly interpolated into JSON query templates without sanitizing JSON metacharacters. This allows attackers with permission to write queries to insert JSON structural characters, thereby altering the constructed MongoDB query. As a result, an attacker could bypass existing query filters and arbitrarily read, modify, or delete documents stored by the application. The weakness is classified as CWE‑943, Untrusted Input Treated as Codec.

Budibase Server instances running any version prior to 3.40.0 are affected. The vendor responsible for the product is Budibase, and the specific product is the Budibase Server software. Only versions older than 3.40.0 contain the vulnerable query interpolation logic.

The vendor-assessed CVSS score is 8.7, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently known to be exploited in the wild. Attackers must be authenticated with query‑write permissions to inject malicious JSON, implying that exposure is limited to environments where such permissions are granted. Nevertheless, once access is achieved, the ability to modify database queries can lead to wide‑scale data breaches or destructive changes. The risk remains high due to the criticality of the data affected and the absence of community or infrastructure mitigations.