CVE-2026-73301

MEDIUM 4.3

Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder permissions, and default-group flags. The disclosure exposes the tenant access-control structure to users who are not builders or administrators. This issue is fixed in version 3.39.25.

CWE	CWE-862
Vendor	budibase
Product	budibase
Published	Aug 12, 2026

Stay Ahead of the Next One

Get instant alerts for budibase budibase

Be the first to know when new medium vulnerabilities affecting budibase budibase are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

Budibase / budibase

< 3.39.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4 github.com: https://github.com/Budibase/budibase/pull/19109 github.com: https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a github.com: https://github.com/Budibase/budibase/releases/tag/3.39.25