Vulnerability · Published Mar 9, 2026 · Assigned by GitHub_M
CVE-2026-25045Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role)
High 8.7
In plain English
A high-severity missing authorization in budibase from Budibase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Official description
Budibase is a low code platform for creating internal tools, workflows, and admin panels. This issue is a combination of Vertical Privilege Escalation and IDOR (Insecure Direct Object Reference) due to missing server-side RBAC checks in the /api/global/users endpoints. A Creator-level user, who should have no permissions to manage users or organizational roles, can instead promote an App Viewer to Tenant Admin, demote a Tenant Admin to App Viewer, or modify the Owner’s account details and all orders (e.g., change name). This is because the API accepts these actions without validating the requesting role, a Creator can replay Owner-only requests using their own session tokens. This leads to full tenant compromise.
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/Budibase/budibase/security/advisories/GHSA-2g39-332f-68p9 x_refsource_CONFIRM