Executive brief
Budibase is an open-source low-code platform used by businesses to build internal applications. A security flaw in the platform's user management system allows any logged-in user, even those with the lowest level of access, to perform administrative tasks. An attacker could use this to view all employee names and emails, create new accounts, delete existing users, or take over other accounts by changing their associated email addresses.
Technical details
A missing authorization check in the SCIM (System for Cross-domain Identity Management) router allows authenticated users with 'BASIC' or 'builder' roles to access administrative endpoints. The vulnerable component, located in `packages/worker/src/api/routes/global/scim.ts`, implements feature-flag checks but fails to include role-based middleware such as `auth.adminOnly`. An attacker can perform CRUD operations on all users and groups within a tenant, potentially leading to PII disclosure, account takeover via email modification, or privilege escalation through group membership manipulation. This issue affects Enterprise tenants where SCIM is enabled and is resolved in version 3.38.2 by adding the necessary authorization middleware.
Affected products
- Budibase Budibase < 3.38.2
Timeline
- 2026-05-13: patched: Version 3.38.2 released
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: CVE-2026-46425 published to NVD