The vulnerability is a server‑side request forgery in the datasource verify endpoint of Budibase Server. Builder‑level users can supply any URL without SSRF validation, causing the server to fetch resources from internal or external targets. By directing requests to attacker‑controlled servers, an adversary can capture CouchDB credentials that the Server uses, granting full access to the internal database. This weakness is classified as CWE‑918, which is a credential leakage via SSRF.

Budibase Server versions older than 3.41.3 are affected. The flaw is present in the Budibase Server product, which allows builder‑level users to provide arbitrary URLs to the datasources verify endpoint without proper validation.

The CVSS score is 8.3, indicating high severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Exploitation requires authenticated builder‑level access to the web interface, but once executed, the attacker obtains internal CouchDB credentials and can read or modify all data in the database in cloud deployments.