Mjashank

**Name of the Vulnerable Software and Affected Versions** Budibase versions prior to 3.39.0 **Description** Budibase is an open-source low-code platform where the `GET` and `PUT` routes for single-datasources are guarded by generic `TABLE READ` permissions instead of Builder/Admin permissions or datasource-specific ownership checks. Because the built-in Basic app user role maps to the `WRITE` permission set (which includes table read/write and query write), a Basic user can read a REST datasource and receive redacted `authConfigs` values. By submitting an update that modifies only the `config.url` while maintaining the redacted placeholders, the `mergeConfigs()` function restores the original stored secret. When a saved relative-path REST query is subsequently triggered via the `POST /api/v2/queries/{queryId}` endpoint, Budibase prefixes the attacker-controlled `config.url` to the query path and applies the stored authorization headers. This results in the server-side disclosure of the builder-configured REST Authorization secret to an external listener controlled by the attacker. **Recommendations** Update Budibase to version 3.39.0. As a temporary mitigation, restrict the use of the `PUT /api/datasources/{datasourceId}` and `GET /api/datasources/{datasourceId}` endpoints to only Builder or Admin roles. Rotate REST datasource authorization secrets for affected deployments after applying the update.