package

npm/@budibase/backend-core

pkg:npm/%40budibase/backend-core

HIGH8.1npm

Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover

Modified: 5/11/2026

MEDIUM4.2npm

Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour

Modified: 9/10/2026

CRITICAL9.6npm

Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist

Modified: 4/3/2026

CRITICAL9.1npm

Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints

Modified: 5/5/2026

HIGH8.5npm

@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation

Modified: 8/12/2026

MEDIUM6.5npm

Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker

Modified: 9/10/2026