CVE-2026-73305

Received Received - Intake

Budibase Role Privilege Escalation via Global Role Update

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to an app they control and then grant themselves builder access or an arbitrary role in another app, exposing that app data, datasource configuration, and automations. This issue is fixed in version 3.39.24.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73305

Affected Vendors & Products

Vendor	Product	Version / Range
budibase	budibase	3.39.24

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Budibase allows an app-scoped builder to escalate their privileges by exploiting a missing validation check in the POST /api/public/v1/roles/assign endpoint. The attacker can scope a request to an app they control and grant themselves builder access or any role in another app, potentially exposing sensitive data, datasource configurations, and automations.

Detection Guidance

Check Budibase server logs for POST requests to /api/public/v1/roles/assign with role assignment attempts. Look for requests where appBuilder.appId or role.appId does not match the target app. Verify server version is 3.39.24 or later.

Impact Analysis

If you use Budibase versions prior to 3.39.24, an attacker with app-scoped builder access could escalate their privileges to gain control over other apps, leading to unauthorized access to data, modifications to configurations, or disruption of automations.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized privilege escalation could result in data breaches, triggering legal and financial penalties.

Mitigation Strategies

Upgrade Budibase to version 3.39.24 or later immediately. Review logs for unauthorized role assignments. Restrict access to the /api/public/v1/roles/assign endpoint if possible.

Hi! I’m here to help you understand CVE-2026-73305. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70