EUVD-2026-32590
GHSA-6xp4-cf37-ppjh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain workspace-scoped builder role + API key
-
DeliverySet target app in x-budibase-app-id header
-
ExploitPOST self/target ID to /api/public/v1/roles/assign with admin.global=true
-
ExecutionMass-assignment grants global admin
-
ImpactFull tenant-wide takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V4 - API and Web Service Object attribute protection
|
| Exploitation Conditions | Exploitation requires (1) a Budibase deployment with an Enterprise license that unlocks the EXPANDED_PUBLIC_API feature, exposing /api/public/v1/roles/assign; (2) the attacker to already possess a workspace/app-scoped builder role (builder.apps set, builder.global unset) for some app; and (3) a valid API key plus the matching x-budibase-app-id header so the builderOrAdmin middleware admits the request. CVSS PR:H confirms authenticated access is needed. Limiting factors: it is not exploitable by anonymous/unauthenticated users, it does not affect Community/non-Enterprise editions or deployments where EXPANDED_PUBLIC_API is disabled, and it is fixed entirely in 3.39.0; no user interaction or special platform is otherwise required. |
| Impact | The CVSS 3.1 base score is 9.0 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L: network-reachable, low complexity, no user interaction, and a Changed scope reflecting that an app-scoped privilege is leveraged to gain authority over the entire tenant. PR:H is the key tempering factor - the attacker must already hold a workspace-scoped builder role plus an API key, so this is post-authentication insider/lateral escalation rather than anonymous compromise. There is no CISA KEV listing and no EPSS score provided, and no public exploit is identified at time of analysis, so the practical risk is gated on whether an organization grants app-level builder roles to semi-trusted users on an Enterprise deployment with EXPANDED_PUBLIC_API enabled. Where that configuration exists the risk is genuinely high (trivial, reliable, full-admin outcome); where builder roles are tightly held it is lower. EPSS data is missing from the input, so widespread-exploitation probability could not be assessed. |
| Exploit ScenarioDerived | Bob holds only a workspace-scoped builder role (builder.apps set, builder.global unset) on a Budibase Enterprise tenant and has an API key. He sends one authenticated POST to /api/public/v1/roles/assign with the affected app's x-budibase-app-id header and a body that sets admin.global=true (or builder.global=true) for his own user ID, immediately gaining tenant-wide administrator access. The attack requires no user interaction and is low-complexity; no public POC is identified at time of analysis, but the advisory documents the exact request flow. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 27, 2026
Privilege escalation in Budibase before 3.39.0 lets a workspace-scoped builder promote themselves or any other user to global administrator with a single POST to /api/public/v1/roles/assign. The builderOrAdmin middleware admits app-level builders (builder.apps set, builder.global unset) and the controller blindly spreads the request body into the SDK, allowing the caller to set builder.global=true or admin.global=true on arbitrary user IDs. The flaw turns a tenant-confined Enterprise feature into full tenant-wide takeover; no public exploit is identified at time of analysis, but the technique is fully described in the GitHub advisory.
RemediationAI
Vendor-released patch: 3.39.0 - upgrade Budibase to 3.39.0 or later, which corrects both the builderOrAdmin authorization check and the role-assignment handling, per advisory GHSA-6xp4-cf37-ppjh (https://github.com/Budibase/budibase/security/advisories/GHSA-6xp4-cf37-ppjh). If immediate upgrade is not possible, reduce exposure by disabling the EXPANDED_PUBLIC_API feature so the /api/public/v1/roles/assign endpoint is not reachable (trade-off: this removes the expanded public API capabilities legitimate integrations may depend on), by revoking or tightly restricting API keys issued to workspace/app-scoped builders, and by minimizing the number of users granted builder roles (trade-off: slows delegated app development). Additionally, audit current global admin and builder.global assignments to detect any unauthorized promotions that may already have occurred, and place network/access controls in front of the public API endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Budibase is an open-source low-code application platform; the affected surface is its public REST API, specifically the role-assignment endpoint exposed when an Enterprise license unlocks the EXPANDED_PUBLIC_API feature. The root cause maps to CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes, i.e. a mass-assignment / object-injection flaw): the controller takes attacker-controlled request-body fields and spreads them directly into an SDK call that mutates the target user's privilege attributes, with no allow-list filtering of which attributes (builder.global, admin.global) may be set. Compounding this, the builderOrAdmin authorization middleware keys off the x-budibase-app-id header and treats any builder for that app as authorized, failing to distinguish a global builder from a workspace/app-scoped builder. EUVD records the affected scope as budibase < 3.39.0.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
1DescriptionGitHub Advisory
Budibase is an open-source low-code platform. Prior to 3.39.0, /api/public/v1/roles/assign is guarded by the builderOrAdmin middleware, which passes any user who is a builder for the app id in the x-budibase-app-id header. That check admits both global builders and workspace-scoped builders (builder.apps set but builder.global unset). The controller then spreads the request body into the SDK call, and the SDK grants builder.global=true or admin.global=true on whichever user ids the caller supplies. Bob, a workspace-scoped builder with an API key, promotes himself or any other user to global admin with one POST. The whole flow is tenant-wide privilege escalation from an app-level role, available to anyone with an Enterprise license that unlocks the EXPANDED_PUBLIC_API feature. This vulnerability is fixed in 3.39.0.
Executive ViewAI
Budibase versions before 3.39.0 contain a critical privilege escalation vulnerability allowing any workspace builder to grant themselves or others global administrator access through a single API call. Organizations running affected versions face complete administrative takeover of their Budibase deployments, enabling attackers with builder-level access to compromise all user data, system configurations, and tenant operations. Immediate upgrade to 3.39.0 or later is required to prevent unauthorized administrative control.
Apply vendor patch: upgrade to Budibase version 3.39.0 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB