CVE-2026-25045 Details

A critical vulnerability in Budibase's low-code platform for internal tools and workflows allows for vertical privilege escalation and insecure direct object reference (IDOR). This issue arises from missing server-side role-based access control (RBAC) checks in the '/api/global/users' endpoint. A user with Creator-level permissions, who should not have the ability to manage users or organizational roles, can exploit this vulnerability to promote an App Viewer to Tenant Admin, demote a Tenant Admin to App Viewer, or alter the Owner's account details and orders. The API fails to validate the requesting user's role, enabling Creators to replay Owner-only requests using their session tokens, resulting in a complete compromise of the tenant.

Budibase should implement strict server-side RBAC checks on the '/api/global/users' endpoint, preventing Creator roles from modifying user details. Additionally, the principle of least privilege should be applied to backend logic to ensure that users can only perform actions appropriate to their roles.