CVE-2026-82240 in Budibase
Summary
by MITRE • 08/28/2026
Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps fields to escalate privileges and gain unauthorized builder access to other applications in the same tenant.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in Budibase versions prior to 3.41.3 represents a critical authorization flaw within the application's role-based access control mechanism, specifically affecting how app-scoped permissions are managed during user creation and update operations. This issue stems from an insufficient validation of input data on the server side when handling requests directed at public endpoints for managing users. In a properly secured system, any attempt to assign or modify roles must strictly adhere to the scope defined by the requesting user's current privileges. However, in this flawed implementation, the backend logic fails to verify whether the builder role assignments being submitted are actually associated with applications that the authenticated user is authorized to manage. This lack of boundary enforcement allows an attacker who possesses valid credentials for a specific application as a builder to manipulate API requests and extend their permissions beyond the intended scope.
From a technical perspective, the core defect lies in the handling of the builder.apps field within the user update API payload. When an authenticated user with app-scoped builder privileges sends a crafted request to modify another user's role or create a new one, they can include identifiers for applications that are unrelated to their own authorized scope. The server processes these requests without cross-referencing them against the requester’s actual permissions matrix. Consequently, this enables privilege escalation where an actor with limited access rights gains administrative-level control over other distinct applications within the same tenant environment. This bypasses the intended isolation between different business units or projects that rely on separate application instances for security and operational separation.
The operational impact of this vulnerability is severe, as it compromises the integrity of multi-tenant architectures where data segregation is paramount. An attacker exploiting this flaw can gain unauthorized builder access to other applications, which typically grants capabilities such as modifying database schemas, altering workflow logic, injecting malicious scripts into pages, or accessing sensitive business data stored within those unrelated apps. This effectively breaks the trust boundary between different parts of an organization's digital infrastructure hosted on the same Budibase instance. The ability to escalate privileges in this manner can lead to widespread data breaches, unauthorized modifications to critical business processes, and potential lateral movement if other systems are linked through shared credentials or integrations configured by these newly elevated accounts.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically the failure to enforce proper authorization checks during privilege assignment operations. It also maps closely to MITRE ATT&CK technique T1078, Valid Accounts, as it involves an attacker leveraging legitimate credentials but abusing their functional permissions through a logic flaw rather than credential theft. Furthermore, the exploitation method relates to CWE-639, Authorization Bypass Through User-Controlled Key, since the attacker controls the application identifiers in the request payload to bypass access restrictions.
To mitigate this risk, organizations running Budibase versions earlier than 3.41.3 must upgrade immediately to version 3.41.3 or later, where the validation logic for app-scoped role assignments has been corrected. Until an update is applied, administrators should enforce strict network-level controls such as firewalls that restrict access to these specific API endpoints only from trusted internal sources if possible. Additionally, implementing robust monitoring and logging of user management activities can help detect anomalous patterns indicative of privilege escalation attempts. Regular audits of role assignments across all applications within a tenant are also recommended to identify any unauthorized changes resulting from potential exploitation before the patch is deployed.