Budibase CVE-2026-73305
HIGH
GHSA-j9fc-w3mr-x6mv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
S:C because attacker crosses app isolation boundaries to impact resources outside their authorization scope; A:N because the exploit grants access rather than disrupting availability.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to an app they control and then grant themselves builder access or an arbitrary role in another app, exposing that app data, datasource configuration, and automations. This issue is fixed in version 3.39.24.
AnalysisAI
Privilege escalation in Budibase's public role-assignment API allows an app-scoped builder to grant themselves or other users builder access - or arbitrary data-plane roles - across any app in a shared tenant. Versions prior to 3.39.24 are affected; the CVSS score of 8.8 (PR:L) reflects that a low-privilege authenticated account is sufficient, with no user interaction or elevated complexity required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold an authenticated session as an app-scoped builder - meaning their account has user.builder.apps containing at least one app ID, but they are not a global builder or admin. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.8 with AV:N/AC:L/PR:L/UI:N is well-calibrated to the actual risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with an authenticated app-scoped builder account for any app in the tenant (e.g., app_allowed) sends a crafted POST /api/public/v1/roles/assign request with the body setting appBuilder.appId to a target app they do not control (e.g., app_target). The unpatched validateGlobalRoleUpdate passes the request through without inspecting the appId, and the pro-tier SDK appends app_target to the attacker's builder.apps list. … |
| Remediation | Upgrade to Budibase 3.39.24 or later, confirmed fixed via release tag https://github.com/Budibase/budibase/releases/tag/3.39.24 and commit 453391d3245dd04cc386ccd6959d38ccf30db9a8 (PR #19098). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Budibase deployments in your environment and confirm installed versions; determine whether your organization uses shared multi-app tenants where this escalation path applies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today