High priorityDisclosed

Advisory · CVE-2026-100686

Budibase group apps endpoint lets builders grant themselves admin elsewhere

Budibase before 3.45.0 fails to validate per-app authorization in POST /api/global/groups/:groupId/apps. A builder of a single workspace can exploit the missing per-app authorization checks to grant themselves admin roles in other workspaces by modifying user group role mappings. Fixed in 3.45.0.

Advisory published September 26, 2026Independent summary
Vendor
Budibase
Product
Budibase
Identifier / CWE
CVE-2026-100686
CWE-269
Action timing
Immediate
ELI5

Explain it like I’m five

The form for assigning your team's roles never checks which team the role belongs to. A team lead fills it in with another team's admin role for themselves, and the system approves it.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Single-workspace builder

    A builder holds a role in just one workspace.

  2. 02Unvalidated endpoint

    POST /api/global/groups/:groupId/apps does not validate per-app authorization.

  3. 03Role mapping edit

    The builder modifies user group role mappings to include admin roles in other workspaces.

  4. 04Escalation

    The builder becomes admin in workspaces they were never granted access to.

What happened

Budibase before 3.45.0 fails to validate per-app authorization in POST /api/global/groups/:groupId/apps (CVE-2026-100686, CVSS 8.6). A builder of a single workspace can exploit the missing per-app authorization checks to grant themselves admin roles in other workspaces by modifying user group role mappings. The issue is fixed in Budibase 3.45.0.

What to do

  1. Upgrade Budibase to 3.45.0 or later.
  2. Audit user group role mappings for admin grants the grantee should not have, especially recent ones.
  3. Review access logs for calls to the group apps endpoint from builder accounts.
  4. Re-confirm workspace isolation assumptions across other group and role endpoints.

Management note

Six Budibase advisories landed in one day, and four of them are authorization or isolation failures. That is a pattern, not a coincidence: if you run Budibase multi-workspace, upgrade to 3.45.0 and audit role assignments as if the boundary was already crossed.