Description

Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Attackers with basic user privileges can access /api/global/license/* endpoints to disable premium features and downgrade deployments for all users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-28T12:16:35.000Z",
  "pubdate": "2026-08-28T12:16:35.000Z",
  "executiveSummary": "Budibase versions prior to 3.41.3 are susceptible to a broken access control vulnerability residing within the application's license management subsystem.\nThe vulnerability originates from a failure to enforce role-based access control (RBAC) on sensitive administrative endpoints, specifically those associated with license key and offline token management.\nAn authenticated attacker with standard, low-privileged user access can interact with /api/global/license/* endpoints to modify global licensing parameters.\nThe impact of this vulnerability is severe, as it permits unauthorized actors to delete legitimate license keys or manipulate offline tokens, effectively disabling premium features and forcing a service downgrade across the entire deployment.\nThe risk is categorized as high, as it allows non-administrative users to impact global system integrity and operational availability without requiring prior elevation of privilege.",
  "technicalDetails": "The vulnerability is classified as a Missing Function Level Access Control, where the backend application fails to validate the authorization level of the requesting user before executing sensitive administrative functions.\nThe affected component is the license management module, specifically the RESTful endpoints located under the /api/global/license/ URI pattern. These endpoints are intended for administrative use only but remain exposed to any user with a valid session token.\nThe root cause is a failure in the application's middleware or controller logic to verify that the user's role possesses administrative privileges before invoking license modification handlers.\nExploitation is straightforward: an attacker authenticates to a Budibase instance using standard user credentials. Once authenticated, the attacker sends crafted HTTP requests—typically DELETE or POST methods—to the /api/global/license/ endpoints. Because the backend lacks RBAC checks, the server processes these requests as if they were originated by an administrator.\nThe attack flow proceeds as follows: 1) Attacker establishes a session as a standard user; 2) Attacker identifies the target license management endpoints through discovery; 3) Attacker initiates requests to delete existing license keys or inject malicious/malformed offline tokens via the insecure API; 4) The application executes the state change in the database, invalidating the instance's license status; 5) All connected users experience an immediate loss of premium feature availability as the system reverts to a restricted state.\nThis vulnerability is restricted to versions before 3.41.3. It requires an authenticated session but does not require administrative privilege escalation, as the endpoint security layer itself is bypassed entirely. The vulnerability affects the global state of the Budibase instance and carries a significant potential for Denial of Service (DoS) regarding premium features."
}