Executive brief
Budibase, a platform for building internal business applications, contains a vulnerability that allows users with limited 'builder' permissions to elevate their own privileges to global administrator. By sending a specially crafted request to the public API, an authorized app builder can grant themselves or others full control over the entire organization's account. This could lead to unauthorized access to all applications, sensitive data sources, user management, and system configurations.
Technical details
A privilege escalation vulnerability exists in the `/api/public/v1/roles/assign` endpoint of Budibase. The endpoint is protected by the `builderOrAdmin` middleware, which incorrectly allows workspace-scoped builders (users restricted to specific apps) to access the role assignment logic. The underlying SDK implementation fails to verify if the caller possesses the permissions they are attempting to grant. Consequently, an attacker with a workspace-scoped builder role and an API key can perform a mass-assignment attack to set `builder.global` or `admin.global` to true for any user ID, including their own. This issue is present in versions prior to 3.39.0 and requires the Enterprise 'EXPANDED_PUBLIC_API' feature to be enabled.
Affected products
- Budibase Budibase < 3.39.0
Timeline
- 2026-05-21: disclosed
- 2026-05-27: advisory: NVD publication
- 2026-06-12: patched: GitHub Advisory published/reviewed