The vulnerability in Budibase occurs when the POST /api/datasources/query endpoint fails to enforce per‑table role restrictions. As a result, users with the BASIC role can read, create, update, or delete rows in any table regardless of the configured permissions, allowing an attacker to compromise the confidentiality and integrity of all application data. This flaw is identified as an instance of Unauthorized Access (CWE-862).

Budibase server releases before version 3.41.3 are affected, including all minor releases of the server component that do not incorporate the patch included in 3.41.3.

The CVSS score of 8.6 classifies this flaw as high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers with BASIC role credentials can submit crafted query requests to the vulnerable endpoint; no additional privileges are required beyond standard authentication. Exploitation requires only the ability to call an authenticated API endpoint, making it straightforward for privileged insiders or compromised accounts to read or modify restricted data.