CVEvulnerability

CVE-2026-73305

8.8 HIGH Published 2026-08-13 Modified 2026-09-08 Official page ↗
Status
Deferred
Published
2026-08-13
Last modified
2026-09-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269, CWE-862, CWE-863

Description

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to an app they control and then grant themselves builder access or an arbitrary role in another app, exposing that app data, datasource configuration, and automations. This issue is fixed in version 3.39.24.

Related

Weakness · CWE (3)

  • CWE-269 Improper Privilege Management weakness
  • CWE-862 Missing Authorization weakness
  • CWE-863 Incorrect Authorization weakness

References