CVE-2026-25045: Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role)
Budibase is a low code platform for creating internal tools, workflows, and admin panels. This issue is a combination of Vertical Privilege Escalation and IDOR (Insecure Direct Object Reference) due to missing server-side RBAC checks in the /api/global/users endpoints. A Creator-level user, who should have no permissions to manage users or organizational roles, can instead promote an App Viewer to Tenant Admin, demote a Tenant Admin to App Viewer, or modify the Owner’s account details and all orders (e.g., change name). This is because the API accepts these actions without validating the requesting role, a Creator can replay Owner-only requests using their own session tokens. This leads to full tenant compromise.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25045?
CVE-2026-25045 has been classified as critical due to the potential for privilege escalation and data exposure.
How do I fix CVE-2026-25045?
To fix CVE-2026-25045, apply the latest patch provided by Budibase that addresses the RBAC and IDOR vulnerabilities.
What software is affected by CVE-2026-25045?
CVE-2026-25045 affects Budibase's low code platform specifically in its user role management system.
What type of vulnerabilities are associated with CVE-2026-25045?
CVE-2026-25045 involves vertical privilege escalation and insecure direct object reference (IDOR) vulnerabilities.
Can I safely use Budibase without addressing CVE-2026-25045?
It is not safe to use Budibase without addressing CVE-2026-25045, as it can lead to unauthorized access and data manipulation.