Executive brief
Budibase is an open-source low-code platform used by businesses to build internal applications. A security flaw in the platform's public API allows users whose administrative or application-level permissions have been revoked to continue using those high-level privileges for up to one hour. This could allow a terminated employee or a user with downgraded access to continue viewing sensitive data or modifying applications during the synchronization delay.
Technical details
A cache inconsistency exists in Budibase prior to version 3.38.2 within the public API role unassignment endpoint (POST /api/public/v1/roles/unassign). While the endpoint correctly updates user documents in CouchDB, it fails to invalidate the corresponding entries in the Redis user cache. The authentication middleware prioritizes this cache, which has a Time-To-Live (TTL) of 3600 seconds. Consequently, an attacker with a valid session whose roles (admin, builder, or app-level) are revoked via the public API can continue to perform authorized actions until the cache expires. This issue specifically affects the public API path; revocations performed via the standard Admin UI correctly trigger cache invalidation.
Affected products
- Budibase Budibase < 3.38.2
Timeline
- 2026-05-13: patched: Fixed in version 3.38.2
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: CVE published to NVD