CVE-2026-100686 Details
Description
Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant themselves admin roles in other workspaces by modifying user group role mappings.
A vulnerability in Budibase in versions prior to 3.45.0 allows for cross-workspace privilege escalation. The issue arises because the application fails to properly validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint. This flaw enables builders from one workspace to assign application roles, such as admin, in other workspaces by manipulating user group role mappings. The vulnerability exploits the fact that the endpoint is only guarded by 'builderOrAdmin', a weaker authorization compared to 'adminOnly', which protects other user-group mutation endpoints.
Users are advised to update Budibase to version 3.45.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026CISA-ADP
Assessed Sep 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Budibase/budibase/security/advisories/GHSA-pp5r-q4fp-mcj3 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Budibase/budibase/security/advisories/GHSA-pp5r-q4fp-mcj3 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/budibase-before-3.45.0-cross-workspace-privilege-escalation-via-post-api-global-groups-groupid-apps | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Budibase | < 3.45.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | [email protected] |
| Sep 30, 2026 | CVE Modified | CISA-ADP |
| Sep 26, 2026 | New CVE Received | [email protected] |