Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-100686 Details

Description

Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant themselves admin roles in other workspaces by modifying user group role mappings.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:8.1 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/Budibase/budibase/security/advisories/GHSA-pp5r-q4fp-mcj3	[email protected]
https://www.vulncheck.com/advisories/budibase-before-3.45.0-cross-workspace-privilege-escalation-via-post-api-global-groups-groupid-apps	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-269	Improper Privilege Management	[email protected]

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes