Budibase versions prior to 3.41.3 expose a missing‑authorization flaw in the POST /api/resources/duplicate endpoint that enables an authenticated builder to inject tables, automations, queries, and screens into any other application. An attacker can specify an arbitrary destination workspace ID within the request body and, once the resources are copied, use directly invoked automations with outbound webhooks to exfiltrate data from victim applications. The flaw is a classic Missing Authorization weakness (CWE‑862) and therefore permits unauthorized configuration changes and data leakage.

The vulnerability affects the Budibase server component, specifically any deployment running a version earlier than 3.41.3. Users who have builder privileges in their own workspace can misuse the duplicate endpoint to affect other workspaces without holding a role there.

The CVSS score of 8.3 indicates a high severity potential for unauthorized resource manipulation and data exfiltration. EPSS information is not available, and the vulnerability is not listed in CISA KEV, suggesting no confirmed remote exploitation reports yet. The attacker would send a crafted POST request to the vulnerable endpoint, reference an arbitrary workspace ID, and later trigger any injected automations to transmit data outwards. Because the exploit requires only builder credentials and no specific role in the target workspace, the risk impact spans multiple applications within an organization.