Junglewise Threat Intelligence

Budibase missing authorization in group listing endpoint

Severity: medium · CVSS 4.3 · Published 2026-07-24

Technologies: @budibase/server (npm). Vendors: Budibase, npm.

Executive brief

Budibase is a low-code platform used to build internal business applications. A security flaw in its group management system allows any registered user, even those with the lowest level of access, to view a complete list of all user groups within the organization. This includes sensitive information such as group names, which users belong to which groups, and what specific permissions those groups have across different applications, potentially helping an attacker plan further unauthorized activities.

Technical details

The `GET /api/global/groups` endpoint in the Budibase worker service lacks role-based access control (RBAC) middleware. While other group-related endpoints require 'builder' or 'admin' privileges, this specific listing endpoint is accessible to any authenticated user, including those with the 'BASIC' role. An attacker with valid credentials can exploit this to retrieve a JSON response containing all group names, user memberships (user IDs), role mappings for specific apps, and builder permission flags. This vulnerability is rooted in `packages/worker/src/api/routes/global/groups.ts` where the authorization middleware was omitted. The issue is addressed in version 3.40.0 by adding the `auth.builderOrAdmin` middleware to the affected route.

Affected products

  • Budibase @budibase/server <= 3.38.1

Timeline

  • 2026-06-30: other: Pull request created to fix the issue
  • 2026-07-01: patched: Fix merged into master branch
  • 2026-07-22: disclosed: Advisory published by vendor
  • 2026-07-24: advisory: GitHub Advisory Database entry updated

References

Related threats