Budibase Server EUVD-2026-67697

Exploitation requires a valid authenticated Budibase session - any user account role, including the lowest privilege tier, is sufficient. No special server configuration, non-default feature enablement, or elevated access is needed; the vulnerable /api/global/license/* endpoints are present and reachable in all default installations of Budibase before 3.41.3. Unauthenticated access is not possible, which limits exploitation to users with at least a basic platform account. The impact is confined to license state manipulation - disabling premium features or invalidating offline tokens for all users - and does not enable data exfiltration, code execution, or account takeover. Cloud-managed Budibase instances may have additional infrastructure controls that restrict direct API access, but self-hosted deployments are the primary risk surface.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) is consistent with the description: network-reachable, no complexity, any authenticated user, no interaction needed. High integrity and availability impacts reflect that license deletion immediately affects all platform users, not just the attacker's own session - a denial-of-service via feature stripping. No confidentiality impact is expected since the flaw is write/delete, not read. No EPSS data was provided and the CVE carries no KEV listing, indicating no confirmed active exploitation at time of analysis. Despite the absence of a public exploit, the attack is mechanically simple - a single authenticated HTTP DELETE to a known path - and the barrier of 'authenticated user' may be low in organizations with open Budibase registration or shared accounts. The primary risk is availability/integrity disruption to the business, not data exfiltration or lateral movement.

An authenticated Budibase user with the lowest-privilege role issues an HTTP DELETE request to /api/global/license/ using their standard session token. The server processes the request without performing a role check, removes the active license key, and immediately strips premium features from the entire deployment for all users. No public exploit code exists at time of analysis, but the attack requires only a valid session and knowledge of the endpoint path, which is documented in Budibase's public API references.