CVE-2026-100686 in server
Summary
by MITRE • 09/26/2026
Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant themselves admin roles in other workspaces by modifying user group role mappings.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in Budibase versions prior to 3.45.0 represents a critical failure in access control mechanisms, specifically categorized under CWE-284 Improper Access Control and aligned with the MITRE ATT&CK technique T1078 Valid Accounts for lateral movement or privilege escalation within multi-tenant environments. The core technical flaw resides in the API endpoint POST /api/global/groups/:groupId/apps, which is designed to manage application roles associated with specific user groups. In a properly secured system, this operation should enforce strict per-app authorization checks to ensure that only users with appropriate permissions for both the target group and the specific application can modify these mappings. However, the implementation in affected versions lacks sufficient validation of whether the requesting builder has administrative privileges over the workspace containing the target application or user group. This oversight allows an authenticated attacker who holds builder-level access within a single isolated workspace to craft malicious requests that manipulate role assignments across different workspaces entirely unrelated to their own domain.
By exploiting this missing authorization check, an attacker can assign themselves elevated roles, such as admin privileges, in other workspaces where they previously held no permissions or only limited viewer status. This cross-workspace privilege escalation effectively breaks the logical isolation intended by Budibase’s multi-tenant architecture. The operational impact is severe, as it grants unauthorized users full control over sensitive data and configurations outside their designated scope. Attackers can exfiltrate confidential information, modify application logic to introduce backdoors, or disrupt services for other tenants sharing the same instance. This capability undermines trust in platform security models that rely on workspace boundaries to segregate user identities and permissions, potentially leading to significant compliance violations depending on the regulatory framework governing the data involved.
Mitigation strategies must prioritize immediate patching of all Budibase instances to version 3.45.0 or later, where these authorization checks have been rigorously enforced. For organizations unable to update immediately due to operational constraints, implementing a Web Application Firewall rule set that monitors for anomalous patterns in group-to-application role mapping requests can provide temporary relief. Security teams should also audit existing user permissions and review API logs for any evidence of unauthorized cross-workspace modifications. Furthermore, adopting the principle of least privilege during initial configuration ensures that even if similar vulnerabilities arise in future updates, the blast radius remains contained within strictly defined boundaries. Regular penetration testing focused on horizontal and vertical privilege escalation vectors is recommended to validate the effectiveness of these controls over time.