Is CVE-2026-72853 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-72853?

CVE-2026-72853 has a CVSS v3 severity of HIGH (7.6).

Back

CVE-2026-72853

Description

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.