EUVD-2026-57397
GHSA-4qcj-m5wp-jmf4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible HTTP API requiring only a valid low-privilege session (PR:L, AV:N, AC:L); impact is limited to group metadata disclosure with no integrity or availability consequence.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder permissions, and default-group flags. The disclosure exposes the tenant access-control structure to users who are not builders or administrators. This issue is fixed in version 3.39.25.
AnalysisAI
Missing RBAC middleware on Budibase's GET /api/global/groups API endpoint allows any authenticated BASIC-role user to enumerate all tenant groups, role-to-application mappings, member user lists, builder permission flags, and default-group designations that should be restricted to builders and administrators. All Budibase versions prior to 3.39.25 are affected across both self-hosted and cloud deployments. No active exploitation is confirmed in CISA KEV, but a complete proof-of-concept with Docker-based reproduction steps is publicly disclosed in GitHub Security Advisory GHSA-4qcj-m5wp-jmf4, reducing exploitation effort to near zero for any tenant user with a valid session.
Technical ContextAI
The vulnerability resides in packages/worker/src/api/routes/global/groups.ts within Budibase's worker microservice, which exposes the global administrative API for multi-tenant deployments. Budibase uses an Express-style middleware chain where auth.builderOrAdmin guards privileged endpoints; the single-resource GET /api/global/groups/:id endpoint correctly applied this guard, but the collection-listing GET /api/global/groups route omitted it entirely. CWE-862 (Missing Authorization) precisely describes this inconsistent enforcement pattern - access control exists for some operations on a resource but is absent for others on the same resource surface. The one-line fix (adding auth.builderOrAdmin to the router chain) and accompanying regression test confirm the root cause. CPE cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:* covers all pre-3.39.25 releases; the affected package is @budibase/worker within the monorepo.
RemediationAI
Upgrade Budibase to version 3.39.25 or later, which adds the missing auth.builderOrAdmin middleware to the GET /api/global/groups route. The patched release is confirmed at https://github.com/Budibase/budibase/releases/tag/3.39.25, implemented via PR #19109 (https://github.com/Budibase/budibase/pull/19109) and commit 93db77846e68231ba655f180581c94503985421a. For self-hosted Docker deployments, pull the updated image tagged 3.39.25 or later. If immediate upgrade is not possible, a compensating control is to restrict network-level access to the Budibase worker service API so that only trusted internal services and administrator clients can reach it - note this may break application functionality if end-user apps directly call worker API endpoints. Alternatively, tenant administrators can minimize the number of BASIC-role accounts in sensitive tenants until the patch is applied, since the vulnerability requires a valid authenticated session.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaS
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Unauthenticated account takeover of pending invited users in Budibase Server (@budibase/server) versions 3.41.0 through
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today