Budibase CVE-2026-73305
HIGH
GHSA-j9fc-w3mr-x6mv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain app-scoped builder credentials
-
DeliverySend POST /api/public/v1/roles/assign with crafted appBuilder.appId targeting victim app
-
ExploitvalidateGlobalRoleUpdate skips appId scope check
-
ExecutionSDK appends victim app to attacker builder.apps
-
PersistAttacker opens victim app in builder
-
ImpactExfiltrate datasource credentials and app data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must hold an authenticated session as an app-scoped builder - meaning their account has user.builder.apps containing at least one app ID, but they are not a global builder or admin. The tenant must have the expanded public API enabled (isExpandedPublicApiEnabled license check must pass on the Budibase instance). The builderOrAdmin middleware on the /api/public/v1/roles endpoint is satisfied by any builder account regardless of scope, providing no additional barrier. Exploitation is blocked for unauthenticated users and for non-builder basic user accounts. The attack is limited to horizontal privilege escalation within a single Budibase tenant - it cannot cross tenant boundaries. No special network positioning is required beyond the ability to reach the Budibase API over HTTP/HTTPS. |
| Impact | CVSS 8.8 with AV:N/AC:L/PR:L/UI:N is well-calibrated to the actual risk. Any authenticated app-scoped builder can exploit this over the network with low complexity, making this a realistic, repeatable attack in multi-tenant Budibase deployments. The vendor's GHSA advisory confirms reproduction in an authorized lab environment. No EPSS data was provided and no CISA KEV listing exists at time of analysis, so exploitation appears opportunistic rather than confirmed widespread. The practical blast radius in a multi-team Budibase instance is high: a compromised or malicious builder account for any single app can pivot to full builder access on every other app in the tenant, gaining access to datasource credentials (database connection strings, API keys) and automation logic. The risk is lower in single-team or single-app deployments where no isolation boundary exists to cross. There is no conflict between the CVSS vector and the description - both consistently indicate authenticated network exploitation. |
| Exploit ScenarioDerived | An attacker with an authenticated app-scoped builder account for any app in the tenant (e.g., app_allowed) sends a crafted POST /api/public/v1/roles/assign request with the body setting appBuilder.appId to a target app they do not control (e.g., app_target). The unpatched validateGlobalRoleUpdate passes the request through without inspecting the appId, and the pro-tier SDK appends app_target to the attacker's builder.apps list. The attacker can now open app_target in the Budibase builder, read its datasource connection credentials, and exfiltrate or modify its data and automations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 13, 2026
Privilege escalation in Budibase's public role-assignment API allows an app-scoped builder to grant themselves or other users builder access - or arbitrary data-plane roles - across any app in a shared tenant. Versions prior to 3.39.24 are affected; the CVSS score of 8.8 (PR:L) reflects that a low-privilege authenticated account is sufficient, with no user interaction or elevated complexity required. No public exploit or CISA KEV listing is identified at time of analysis, but the vulnerability is straightforwardly reproducible given the published commit diff and GHSA advisory detail.
RemediationAI
Upgrade to Budibase 3.39.24 or later, confirmed fixed via release tag https://github.com/Budibase/budibase/releases/tag/3.39.24 and commit 453391d3245dd04cc386ccd6959d38ccf30db9a8 (PR #19098). The patch adds validateAppRoleUpdate calls that verify the caller is either a global admin or a builder of the specific target appId before processing appBuilder or role grant vectors. If an immediate upgrade is not feasible, restrict network access to POST /api/public/v1/roles/assign to admin-only traffic at the API gateway or reverse-proxy layer - note this will break any legitimate automated role-assignment workflows using the public API. Alternatively, if the expanded public API can be disabled via the isExpandedPublicApiEnabled license flag without business impact, doing so removes the vulnerable code path entirely; verify this does not break other public API integrations before applying. Audit existing user role assignments for unexpected cross-app builder grants as a detection measure.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in packages/server/src/api/controllers/public/globalRoleValidation.ts. The validateGlobalRoleUpdate function implemented an allowlist limited to two global flags - admin (checked via isAdmin) and builder (checked via isGlobalBuilder) - because the GlobalRoleUpdate TypeScript interface only declared those two fields. Two additional grant vectors, appBuilder (which sets user.builder.apps) and role (which sets user.roles[appId]), were accepted in the request body and forwarded directly to the pro-tier SDK without any authorization check that the caller controls the target appId. The downstream SDK logic in packages/pro/src/sdk/publicApi/roles.ts performs direct array mutation on the target user record. The only gate on the endpoint is builderOrAdmin middleware, which is satisfied by any app-scoped builder. CWE-269 (Improper Privilege Management) identifies the root cause: privilege grants were validated at the flag level (global admin/builder) but not at the scope level (which app the grant targets).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
S:C because attacker crosses app isolation boundaries to impact resources outside their authorization scope; A:N because the exploit grants access rather than disrupting availability.
Primary rating from Vendor (github).
CVSS VectorVendor: github
DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to an app they control and then grant themselves builder access or an arbitrary role in another app, exposing that app data, datasource configuration, and automations. This issue is fixed in version 3.39.24.
Executive ViewAI
A privilege escalation vulnerability in Budibase enables authenticated users to escalate permissions and gain unauthorized access to any application within a shared tenant, risking cross-application data exposure and loss of application integrity controls. Organizations running multi-app, multi-user Budibase deployments face potential compromise if any authenticated account is created or compromised. The threat is material for shared-tenant architectures where application isolation is a security boundary.
No vendor-released patch identified at time of analysis; interim mitigations include restricting non-admin user access to public role-assignment APIs and application configuration endpoints, implementing comprehensive audit logging for permission-change events, enforcing strict tenant or application-level access isolation, and conducting access reviews to minimize the number of authenticated accounts that could serve as attack entry points.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB