CVE-2026-100686

HIGH 8.1

Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant themselves admin roles in other workspaces by modifying user group role mappings.

CWE	CWE-269
Vendor	budibase
Product	server
Published	Sep 26, 2026

Stay Ahead of the Next One

Get instant alerts for budibase server

Be the first to know when new high vulnerabilities affecting budibase server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

budibase / server

0 < 3.45.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Budibase/budibase/security/advisories/GHSA-pp5r-q4fp-mcj3 vulncheck.com: https://www.vulncheck.com/advisories/budibase-before-3.45.0-cross-workspace-privilege-escalation-via-post-api-global-groups-groupid-apps

Credits

🔍 moratoantoine