Komyunghan

A race condition exists in the refresh-token rotation process. This occurs because the `UserRefreshToken.ts` file does not verify the affected-row count during the rotation. Consequently, an attacker who has captured a refresh token can present it simultaneously with the legitimate user to establish a valid authenticated session without triggering a reuse event record.

An authorization flaw exists in the integration creation process within the `integrations.service.ts` file. Specifically, the copy-from logic decrypts connection credentials of a source integration without verifying the owner or the private status flag. Authenticated users with the Creator role can exploit this by providing guessed or enumerated integration identifiers to copy private database hosts, usernames, and passwords from other users into an integration they control.

Improper privilege management in `org-users.service.ts` allows updating a user's legacy organization role to rewrite their `default-workspace` role. This enables revoked users to silently regain Creator-level read, write, and schema modification access across all `default-workspace` bases by utilizing their existing session token.

An incorrect authorization issue exists where base-scoped API tokens function as account-wide credentials. This occurs because the `base id` associated with the token is neither stored nor verified. Consequently, an attacker possessing a leaked token can read, write, and delete records across all bases the token owner is a member of, including those joined after the token was created.

Insufficient route-level permission checks and a lack of workspace or ownership validation in the backing service allow authenticated low-privilege users or those with a valid API key to access or delete document-store upsert history from other users and workspaces. This occurs when the target `chatflowId` (publicly exposed in share links) or row IDs are known. The issue involves the endpoints "GET /api/v1/upsert-history/:id" and "PATCH /api/v1/upsert-history", specifically within the `getAllUpsertHistory()` and `patchDeleteUpsertHistory()` functions. The `getAllUpsertHistory()` function returns rows based on an attacker-supplied `chatflowid`, while `patchDeleteUpsertHistory()` deletes rows using an attacker-supplied array of record UUIDs. Exposed data in the `flowData` and `result` fields may include embedding, record-manager, and vector-store node configurations, including per-node `paramValues`.

Insufficient validation of `organizationId` ownership in database write and destroy routes allows users with the builder role to perform unauthorized actions on databases belonging to other organizations. Due to missing organization-resolving guards, an attacker can create, modify, or permanently delete tables and schemas across tenant boundaries on shared instances.

An issue exists where organization membership is not validated in database read routes. This allows any authenticated user to access table schemas and row data belonging to other organizations. An attacker can provide arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and execute join queries to read stored data from victim organizations.

Budibase contains a route-level authorization misconfiguration where the endpoint "PUT /api/datasources/:datasourceId" is incorrectly assigned to the `authorizedRoutes` group with `TABLE/READ` permissions instead of the `builderRoutes` group. This allows any authenticated user with the `BASIC` built-in role or higher to submit requests to rewrite a datasource's `config` object, including the `host`, `port`, database credentials, or the base `url` of a REST datasource. Because SQL driver connections lack network-level Server-Side Request Forgery (SSRF) protection—a technique where an attacker forces a server to make requests to an unintended location—redirecting a PostgreSQL, MySQL, or MongoDB datasource to an internal IP address allows an attacker to probe or interact with internal services on arbitrary ports. Additionally, this can be used to disrupt service by injecting invalid configurations, causing a Denial of Service (DoS) for all application queries depending on that datasource.