Budibase EUVD-2026-67692

Exploitation requires an authenticated, app-scoped builder account within the target Budibase tenant; unauthenticated access is not possible, as confirmed by CVSS PR:L. The attacker must have network access to the Budibase user create or update API endpoints. No special server configuration or non-default feature flag is required beyond a standard multi-tenant Budibase deployment with at least two distinct applications and separate builder role assignments. Exploitation is strictly bounded within the attacker's tenant - cross-tenant privilege escalation is not possible. The limiting factors are: (1) possession of a valid app-scoped builder credential, and (2) knowledge of target application IDs within the tenant (which may be discoverable via other API calls available to builders).

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) accurately reflects the real-world threat surface: the attack is network-accessible, requires no special attack conditions, demands only a low-privilege existing account, and yields full confidentiality and integrity compromise of additional tenant applications. No EPSS data was supplied, and neither a CISA KEV listing nor a public exploit has been identified at time of analysis - these signals marginally reduce urgency relative to raw CVSS. However, the low attack complexity means that any authenticated builder with grievance or malicious intent can independently discover and execute this escalation without external tooling. The primary limiting factor is the prerequisite of a valid app-scoped builder credential within the target tenant; unauthenticated or cross-tenant exploitation is not possible. For SaaS or shared self-hosted instances where builder accounts are issued broadly, the blast radius per compromised account is substantially amplified.

An attacker holding a legitimate app-scoped builder account for a low-sensitivity application within a shared Budibase tenant crafts a PUT request to the user update API, injecting the IDs of sensitive applications they should not access into the builder.apps field. The server processes the request without verifying the requester's authority over those applications, immediately granting the attacker builder-level access - including the ability to view data sources, modify app logic, and read application data. No public exploit code has been identified, but the attack requires only standard HTTP tooling and knowledge of target application IDs.