The listed vulnerability is a Server Side Request Forgery (CWE-918) that arises because the default blacklist in Budibase backend-core does not exclude the 100.64.0.0/10 address range. An authenticated user with Builder permission can submit a REST datasource query preview to the server’s POST /api/queries/preview endpoint, causing the backend to forward the request to a reachable HTTP(S) service within that range and return the response back to the requester. This allows the attacker to communicate with services hidden behind the server’s network, potentially leaking data, bypassing network isolation, or executing further internal attacks.

Budibase server, which incorporates the backend-core component, is affected when it has not defined a custom BLACKLIST_IPS configuration and is running the default blacklist. Any self‑hosted deployment that relies on the default configuration and has users with Builder permission is vulnerable.

The CVSS score of 7.1 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with Builder permission, meaning that an attacker must first gain legitimate access or manipulate an existing account. Once access is achieved, the SSRF can be triggered quickly, allowing the attacker to reach internal hosts in the 100.64.0.0/10 range. The lack of an official patch at publication time increases the window of exposure, but configuration changes can mitigate the risk.