CVE-2026-100686
Received Received - Intake

Budibase Missing Authorization in Group Role Assignment

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant themselves admin roles in other workspaces by modifying user group role mappings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100686
EUVD
EUVD-2026-87659

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
budibase budibase to 3.45.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100686 is a privilege escalation vulnerability in Budibase versions before 3.45.0. It occurs in the POST /api/global/groups/:groupId/apps endpoint where the application fails to validate per-app authorization properly. This allows a builder in one workspace to assign themselves admin roles in other workspaces by manipulating user group role mappings, bypassing workspace boundaries.

Detection Guidance

To detect this vulnerability, check Budibase server versions prior to 3.45.0. Inspect API logs for POST requests to /api/global/groups/:groupId/apps with role modifications. Look for unauthorized role assignments across workspaces.

Impact Analysis

An attacker with builder access in one workspace could escalate privileges to gain admin roles in other workspaces they do not control. This could lead to unauthorized access to sensitive data, manipulation of applications, and potential data exposure across multiple workspaces.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements for data protection and privacy such as GDPR and HIPAA. Unauthorized access to sensitive data may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Budibase to version 3.45.0 or later immediately. Review user roles and group mappings for unauthorized admin assignments. Implement stricter authorization checks on the affected endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100686. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart