Description

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to an app they control and then grant themselves builder access or an arbitrary role in another app, exposing that app data, datasource configuration, and automations. This issue is fixed in version 3.39.24.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T22:17:25.657Z",
  "pubdate": "2026-08-13T22:17:25.657Z",
  "executiveSummary": "An improper authorization and access control vulnerability exists in Budibase prior to version 3.39.24 within the public global role validation mechanism. The vulnerability resides in the POST /api/public/v1/roles/assign endpoint, which invokes the validateGlobalRoleUpdate function in packages/server/src/api/controllers/public/globalRoleValidation.ts without properly validating appBuilder.appId or role.appId constraints. This security flaw allows an authenticated attacker possessing app-scoped builder privileges within a controlled application to manipulate scope parameters and maliciously assign themselves arbitrary high-privilege roles, such as builder access, across different and unrelated applications. The resulting impact includes unauthorized exposure of sensitive application data, compromise of enterprise datasource configurations, and potential hijacking of backend automations. Successful exploitation requires an attacker to already possess authenticated app-scoped builder access, enabling them to leverage insufficient server-side boundary checks to escalate their privileges horizontally and vertically across the multi-tenant low-code environment. Remediation requires upgrading Budibase to version 3.39.24 or later, where strict contextual boundary checks enforce proper role and application identifier validation.",
  "technicalDetails": "The vulnerability is an authorization bypass and access control flaw affecting the Budibase low-code platform prior to version 3.39.24. The vulnerable component is located within the server-side API controller file packages/server/src/api/controllers/public/globalRoleValidation.ts, specifically inside the validation logic handled by the validateGlobalRoleUpdate function called during execution of the POST /api/public/v1/roles/assign endpoint.\nThe root cause of the vulnerability stems from inadequate server-side validation of application scope identifiers. When processing role assignment requests, the endpoint fails to rigorously cross-reference or enforce constraints against appBuilder.appId and role.appId. Consequently, the API fails to verify whether the requesting user possesses administrative or sufficient authorization boundaries over the target application context specified in the payload.\nThe attack flow proceeds as follows: An attacker authenticated with standard, low-privileged app-scoped builder access within a benign or attacker-controlled application initiates an HTTP POST request to /api/public/v1/roles/assign. Within the body of the request, the attacker crafts malicious parameters that deliberately manipulate or scope the payload toward a completely separate, victim-controlled or sensitive application. Because the backend validateGlobalRoleUpdate function lacks explicit validation checking for appBuilder.appId or role.appId mismatches, the application processes the request assuming valid contextual parameters.\nAs a result of this flawed validation, the server executes the role assignment, granting the attacker arbitrary elevated roles—such as full application builder privileges—within the targeted, victim-owned application. Network exposure is present via the HTTP API interface accessible to authenticated users. Post-exploitation impact is severe, granting the attacker unauthorized access to view and modify sensitive application data, inspect and abuse connected enterprise datasource configurations, and manipulate or execute arbitrary backend automations tied to the compromised application."
}