Executive brief
Budibase is a low-code platform for building internal business applications. A missing authorization check on the group listing API allows any authenticated user with basic (non-admin) privileges to enumerate all user groups, their role mappings, and access permissions. This enables attackers to map the organization's access control structure and user roles, facilitating privilege escalation attacks and reconnaissance.
Technical details
The vulnerability is a missing authorization (CWE-862) in Budibase's group enumeration API endpoint. The GET /api/global/groups handler in packages/worker/src/api/routes/global/groups.ts lacks the auth.builderOrAdmin middleware present on all other group endpoints (POST, DELETE, and single GET operations). An authenticated attacker with BASIC role privileges can send an HTTP GET request to /api/global/groups and receive complete group metadata including names, role mappings, user membership lists, builder permission flags, and default group indicators. No user interaction or elevated privileges are required beyond basic authentication. The fix requires adding the auth.builderOrAdmin middleware to the list endpoint, as shipped in version 3.40.0 and earlier patched versions.
Affected products
- Budibase Budibase <3.40.0
Timeline
- 2026-07-24: disclosed
- 2026-07-01: patched: Fixed in version 3.40.0
References
- https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4
- https://github.com/Budibase/budibase/pull/19109
- https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a
- https://github.com/Budibase/budibase
- https://github.com/Budibase/budibase/releases/tag/3.39.25