CVE-2026-73305
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Budibase prior to 3.39.24 has a vulnerability in the POST /api/public/v1/roles/assign endpoint where appBuilder.appId or role.appId is not validated. An app-scoped builder can grant themselves builder access or arbitrary roles in another app, exposing data, datasource configuration, and automations. Fixed in version 3.39.24.
Risk Assessment
The risk includes privilege escalation and unauthorized access to sensitive data and configurations across apps, potentially compromising the entire platform.
Recommendation
Upgrade Budibase to version 3.39.24 or later to prevent privilege escalation.
Original NVD description (English source)
Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to an app they control and then grant themselves builder access or an arbitrary role in another app, exposing that app data, datasource configuration, and automations. This issue is fixed in version 3.39.24.