CVE-2026-25040 Details

A critical privilege escalation vulnerability has been identified in Budibase versions through 3.26.3. This issue allows Creator-level users, who typically lack the permission to invite users, to manipulate API requests and invite new users with any role—Admin, Creator, or App Viewer. The vulnerability also enables assignment to any group within the organization, potentially leading to a complete takeover of the workspace or organization. The API fails to enforce role-based access controls, allowing unauthorized actions to go undetected.

Budibase should implement strict server-side role-based access control checks for all API endpoints that manage users, roles, or group memberships. Additionally, logging and alerting on privilege escalation attempts from low-privilege accounts could help detect and address such abuses.