P4Verified

CVE-2026-82242: server 0 to before 3.41.3

CVE-2026-82242. CVSS 3.1 base score 7.7 (HIGH, Vendor/CNA). EPSS 0.00338 (percentile 0.25108), scored 2026-10-06.

Affected technology

server · 0 to before 3.41.3
budibase

Description’s affected range: versions before 3.41.3

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers can inject resources by specifying an arbitrary destination workspace ID in the request body, then trigger injected automations with outgoing webhooks to exfiltrate data from victim applications. Vendor/CNA’s CVSS 4.0 assessment (base score 8.3/10) rates confidentiality and availability impact as none; integrity impact as high.

Published 2026-10-08 17:34:51.845750+00:00

CWE: CWE-862
CCR priority: 30.9 /100 (P4)
CVSS 3.1: 7.7 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N · Vendor/CNA
EPSS: 0.00338 · percentile 0.25218 · 2026-10-08
KEV: no

Provenance

FIRST EPSS daily exploit-probability · Source record · observed 2026-10-08 17:36:22.845483+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-08 17:32:11.049884+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-82242.html