Budibase: Privilege escalation via public role assignment API missing app-level authorization
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation, Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269 and CWE-862.
Summary
Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to an app they control and then grant themselves builder access or an arbitrary role in another app, exposing that app data, datasource configuration, and automations. This issue is fixed in version 3.39.24.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Budibase | budibase | before 3.39.24 | 3.39.24 | Patch available | CNA |
| — | @budibase/server (npm) | up to 3.38.1 | — | No fix listed | GHSA-j9fc-w3mr-x6mv |
- budibase VendorBudibase Affected before 3.39.24 Fixed in 3.39.24 Patch available CNA
- @budibase/server (npm) Vendor— Affected up to 3.38.1 Fixed in — No fix listed GHSA-j9fc-w3mr-x6mv
Remediation
- Fix · CNA budibase (Budibase) Fixed in 3.39.24
Timeline
- 2026-10-02 Threatist record created from CVE-2026-73305
- 2026-10-03 Alias added: GHSA-j9fc-w3mr-x6mv
References
Other 6
- https://github.com/Budibase/budibase/security/advisories/GHSA-j9fc-w3mr-x6mv
- https://github.com/Budibase/budibase/pull/19098
- https://github.com/Budibase/budibase/commit/453391d3245dd04cc386ccd6959d38ccf30db9a8
- https://github.com/Budibase/budibase/releases/tag/3.39.24
- https://github.com/Budibase/budibase
- https://github.com/Budibase/budibase/releases/tag/3.40.0
More Budibase vulnerabilities
- TI-2026-39242 Budibase: Anonymous NoSQL operator injection via published-app query templates CVSS 3.1CRITICAL 10.0
- TI-2026-51076 Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook CVSS 4.0CRITICAL 9.0
- TI-2026-24369 Budibase Universal Auth Bypass via Webhook Query Param Injection CVSS 3.1CRITICAL 9.1
- TI-2026-56709 Budibase before 3.41.3 Remote Code Execution via Plugin eval() CVSS 4.0CRITICAL 9.4
- TI-2026-51425 Budibase: SQL Injection via `multipleStatements: true` CVSS 3.1CRITICAL 9.6
- TI-2026-51075 Budibase before 3.40.0 Arbitrary File Write via Path Traversal CVSS 4.0CRITICAL 9.4
Sources
- CVE-2026-73305 · CVE Program
- CVE-2026-73305 · NVD
- FIRST EPSS
- GHSA-j9fc-w3mr-x6mv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences