CVE-2026-73301

MediumCVSS 4.3

Published: 12/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

17th percentile - higher than 17% of all known CVEs

Summary

In Budibase prior to 3.39.25, the GET /api/global/groups endpoint omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings, user memberships, builder permissions, and default-group flags.

Risk Assessment

Disclosure of the access control structure could help an attacker in privilege escalation or further attacks.

Recommendation

Upgrade Budibase to version 3.39.25 or later.

Original NVD description (English source)

Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder permissions, and default-group flags. The disclosure exposes the tenant access-control structure to users who are not builders or administrators. This issue is fixed in version 3.39.25.