Description

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps fields to escalate privileges and gain unauthorized builder access to other applications in the same tenant.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-28T12:16:34.030Z",
  "pubdate": "2026-08-28T12:16:34.030Z",
  "executiveSummary": "Budibase versions prior to 3.41.3 contain a critical broken access control vulnerability within its user management framework. The flaw resides in the public user creation and update endpoints, where the system fails to perform server-side validation of app-scoped builder role assignments. An authenticated user currently possessing builder permissions for a specific application can exploit this logic flaw to modify the builder.apps field for user records. This unauthorized modification allows the attacker to elevate the privileges of their own account or other accounts, granting arbitrary builder access to additional, unrelated applications within the same tenant. The vulnerability poses a significant risk to multi-tenant environments, as it bypasses the principle of least privilege and allows for unauthorized cross-application configuration and data access. Successful exploitation requires an existing authenticated session with at least limited builder scope; however, it does not require administrative super-user status. The impact includes full compromise of targeted applications, potential data exfiltration, and unauthorized modification of application infrastructure by malicious actors operating from within the platform's user base.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the API request validation layer for the user update and creation endpoints. Specifically, the backend logic trusts the 'builder.apps' array provided in the request body without verifying whether the authenticated user has the necessary administrative authority to assign such roles or if the requested scope is permitted for that specific user context. Budibase uses an app-scoped role model, intended to isolate administrative capabilities to specific development environments; however, the lack of server-side sanitization allows the manipulation of these access control lists (ACLs).\nThe attack flow begins when an attacker, already authenticated as a builder for at least one application, intercepts the API request intended for user profile updates. By interacting with the user update API, the attacker injects or modifies the 'builder.apps' metadata field in the JSON payload. Because the server fails to enforce boundary checks between the attacker's assigned applications and the requested applications, the backend persistence layer updates the user's role assignments globally within the tenant scope. This effectively promotes the attacker's user identity to a builder status for unauthorized applications.\nThe vulnerable component is the User Management API, which processes modifications to user roles and permissions. The flaw exists because the endpoint logic assumes the client-side state is authoritative regarding which applications a user should be permitted to manage. Exploitation is feasible via standard HTTP requests once the attacker obtains a valid session token. By submitting a crafted POST or PUT request, the attacker can systematically add their User ID to the builder list of any application hosted under the same tenant account. Once the server processes the payload, the updated session permissions are immediately reflected in the attacker's authorization token upon the next request, effectively bypassing the access control checks governing application-level management. This enables the attacker to modify, delete, or export data across arbitrary applications, leading to a complete breakdown of internal security boundaries."
}