CVE-2026-41428: 
JavaScript vulnerability analysis and mitigation

CVE-2026-41428 is a critical authentication bypass vulnerability in Budibase, an open-source low-code platform, caused by unanchored regular expressions in the authenticated middleware. All versions prior to 3.35.4 of the @budibase/backend-core npm package are affected. The vulnerability was published on April 24, 2026, with the security advisory authored by mjashanks and credited to researcher AyushParkara. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, Feedly).

The root cause is CWE-287 (Improper Authentication): the middleware in packages/backend-core/src/middleware/matchers.ts compiles public endpoint route patterns into regular expressions without anchors (^ prefix or $ suffix), and then tests those regexes against ctx.request.url in Koa, which includes the full query string. Because the regex is unanchored, appending a public endpoint path (e.g., /api/system/status) as a query parameter value causes the regex to match within the query string, setting ctx.publicEndpoint = true and causing the global 403 authentication check in packages/worker/src/api/index.ts to be skipped entirely. Endpoints registered on loggedInRoutes — which have no secondary per-route authentication middleware — are fully exposed; endpoints on builderOrAdminRoutes or adminRoutes are not affected because they have independent secondary middleware that checks ctx.user. The fix involves either anchoring the regex (new RegExp('^' + route + '(\?|$)')) or testing against ctx.request.path instead of ctx.request.url (GitHub Advisory).

An unauthenticated remote attacker can access protected API endpoints without any credentials, enabling full user directory enumeration (emails, names, roles, admin/builder status) via POST /api/global/users/search, account holder identification via GET /api/global/users/accountholder, and the ability to publish arbitrary events or trigger license refresh operations. The user search endpoint is particularly damaging as it exposes the complete user directory of a Budibase instance to anyone on the internet, facilitating targeted phishing, credential stuffing, and privilege escalation attacks. Availability is also impacted through the ability to trigger license refresh operations that may disrupt service (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub security advisory, consisting of concrete curl commands that demonstrate authentication bypass and full user data exfiltration without credentials. The vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially exploitable by any network-accessible attacker. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and the EPSS score is approximately 0.055% (GitHub Advisory, Feedly). The vulnerability is not currently listed in the CISA KEV catalog.

1. Reconnaissance: Identify internet-facing Budibase instances (versions prior to 3.35.4) using Shodan, Censys, or similar tools by searching for Budibase-specific HTTP response headers or page content.
2. Confirm target is vulnerable: Send a normal unauthenticated POST request to a protected endpoint and confirm a 403 response: curl -s -o /dev/null -w "%{http_code}" -X POST -H "Content-Type: application/json" -d '{}' "https://<target>/api/global/users/search"
3. Craft bypass request: Append a known public endpoint path as a query parameter to the protected endpoint URL, exploiting the unanchored regex match against the query string: curl -s -X POST -H "Content-Type: application/json" -d '{}' "https://<target>/api/global/users/search?x=/api/system/status"
4. Enumerate users: The server returns the full user directory including emails, names, roles, and admin status without requiring authentication.
5. Expand access: Use other exposed endpoints for further reconnaissance — GET /api/global/users/accountholder to identify the instance owner, GET /api/global/self for session context, or POST /api/global/event/publish to inject events into the platform's event system.
6. Leverage harvested data: Use enumerated email addresses and role information for targeted phishing, credential stuffing, or to identify high-value admin accounts for further attack (GitHub Advisory).

• Network: HTTP POST requests to /api/global/users/search, /api/global/users/accountholder, /api/global/self, /api/global/license/refresh, or /api/global/event/publish containing query parameters with values matching public endpoint paths (e.g., ?x=/api/system/status, ?x=/api/system/environment, ?x=/api/global/configs/public, ?x=/api/global/auth/default) from unauthenticated sources.
• Logs: Web server or application access logs showing 200 responses to the above protected endpoints from requests lacking valid session tokens or Authorization headers; repeated requests to /api/global/users/search with query string parameters from a single IP or user agent.
• Application Behavior: Unexpected successful responses (HTTP 200) to API endpoints that should return 403 for unauthenticated requests; anomalous spikes in requests to user enumeration endpoints from external IPs (GitHub Advisory).

Upgrade Budibase to version 3.35.4 or later, which fixes the vulnerability by anchoring the regular expressions and/or testing against ctx.request.path instead of ctx.request.url. No configuration-based workaround is available that fully mitigates the issue without patching; however, organizations can reduce exposure by placing Budibase behind a WAF or reverse proxy that blocks requests containing public endpoint path patterns in query strings (e.g., blocking query parameters matching /api/system/status, /api/global/configs/public, etc.). Given the public PoC availability and critical CVSS score, patching should be treated as urgent (GitHub Advisory).

The vulnerability received coverage from The Hacker Wire, which published an article titled "Budibase Critical Auth Bypass via Unanchored Regex" shortly after disclosure (The Hacker Wire). The issue was also discussed on Reddit's r/pwnhub community and noted on Mastodon and Bluesky, reflecting moderate community interest given the critical severity and public PoC. Security blog infinitsec.net published a dedicated technical post analyzing the bypass mechanism (infinitsec).