CVE-2026-73301: Budibase missing RBAC on group enumeration endpoint

CVE-2026-73301 · Severity: low · CVSS 3.1 · Published 2026-07-24

Budibase is a low-code platform for building internal business applications. A missing authorization check on the group listing API allows any authenticated user with basic (non-admin) privileges to enumerate all user groups, their role mappings, and access permissions. This enables attackers to map the organization's access control structure and user roles, facilitating privilege escalation attacks and reconnaissance.

Technologies: @budibase/server (npm). Vendors: npm.

Quick answers

Is CVE-2026-73301 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73301 being exploited in the wild.
How severe is CVE-2026-73301?
Low severity, with a CVSS score of 3.1, published 24 July 2026.
Which products and versions are affected?
@budibase/server (npm) SEMVER:introduced=0,last_affected=3.38.1.
Is there a fix for CVE-2026-73301?
A patch was published on 2026-07-01: Fixed in version 3.40.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73301 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-73301?
Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization (CWE-862) in Budibase's group enumeration API endpoint. The GET /api/global/groups handler in packages/worker/src/api/routes/global/groups.ts lacks the auth.builderOrAdmin middleware present on all other group endpoints (POST, DELETE, and single GET operations). An authenticated attacker with BASIC role privileges can send an HTTP GET request to /api/global/groups and receive complete group metadata including names, role mappings, user membership lists, builder permission flags, and default group indicators. No user interaction or elevated privileges are required beyond basic authentication. The fix requires adding the auth.builderOrAdmin middleware to the list endpoint, as shipped in version 3.40.0 and earlier patched versions.

Affected products

  • Budibase Budibase <3.40.0

Identifiers

  • CVE-2026-73301
  • GHSA-4qcj-m5wp-jmf4

Timeline

  • 2026-07-24: disclosed
  • 2026-07-01: patched: Fixed in version 3.40.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.