Executive brief
Budibase is an open-source platform used by businesses to build internal tools and custom applications. A security flaw in the user onboarding process allows individuals with basic 'builder' permissions to create new administrator accounts for themselves. This grants an attacker full control over the platform, including the ability to access sensitive data, modify applications, and manage other users.
Technical details
A privilege escalation vulnerability exists in Budibase due to improper authorization checks on the '/api/global/users/onboard' endpoint. While administrative invite flows are restricted, this specific endpoint uses 'workspaceBuilderOrAdmin' middleware, which permits users with 'builder' roles to access it. In self-hosted environments where SMTP is not configured, the application defaults to a direct user creation path that fails to validate the roles assigned in the request body. An authenticated attacker with builder-level access can send a crafted POST request to create a new user with 'global admin' privileges. The server's response includes the auto-generated password for the new account, allowing for immediate and full platform compromise. This issue is resolved in version 3.38.1 by moving the endpoint to admin-only routes and removing the unused onboarding logic.
Affected products
- Budibase Budibase < 3.38.1
Timeline
- 2026-05-12: patched: Version 3.38.1 released
- 2026-05-12: advisory: GitHub Security Advisory GHSA-c54j-xp92-wh28 published
- 2026-05-27: disclosed: CVE-2026-45716 published to NVD