CVE-2026-72853: Budibase

High severity, CVSS 7.6. EPSS: 0.3% chance of exploitation in the next 30 days.

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.

Affected products

• Budibase Budibase: before 3.40.0 (fixed in 3.40.0)

Published 2026-08-13. Last modified 2026-08-31.