Budibase privilege escalation in public role assignment API

Executive brief

Budibase, a platform for building internal business applications, is affected by a privilege escalation vulnerability. A user who is only authorized to build or manage a specific application can exploit a flaw in the role-assignment system to grant themselves administrative access to any other application within the same organization. This allows an attacker to view or modify sensitive business data, steal database credentials, and execute unauthorized scripts across the entire tenant.

Technical details

A missing authorization check in the Budibase public role-assignment API (`POST /api/public/v1/roles/assign`) allows app-scoped builders to escalate their privileges. While the endpoint validates global 'admin' and 'builder' flags, it fails to verify if the caller has authority over the specific `appId` provided in the `appBuilder` or `role` objects. An attacker with a valid API key (which can be self-issued by any builder) can send a crafted request to assign themselves as a builder or admin for any application in the tenant. This bypasses workspace isolation, allowing the attacker to exfiltrate datasource credentials and modify server-side automations. The vulnerability affects licensed Business and Enterprise deployments where the expanded public API is enabled.

Affected products

• Budibase @budibase/server <= 3.38.1

Timeline

• 2026-07-22: disclosed
• 2026-07-24: advisory

References

• https://api.github.com/users/dinhvaren
• https://github.com/dinhvaren
• https://api.github.com/users/dinhvaren/gists%7B/gist_id%7D
• https://api.github.com/users/dinhvaren/repos
• https://avatars.githubusercontent.com/u/149681061?v=4
• https://api.github.com/users/dinhvaren/events%7B/privacy%7D