CVE-2026-46425: Budibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant users
Budibase is an open-source low-code platform. Prior to 3.38.2, packages/worker/src/api/routes/global/scim.ts attaches only two middlewares to the SCIM router: requireSCIM (checks the Enterprise feature flag and SCIM config) and doInScimContext (sets the SCIM request context). There is no role check. Any authenticated user who reaches the worker (BASIC role, workspace-scoped builder, anyone) can call SCIM endpoints and CRUD every user and group in the tenant. This vulnerability is fixed in 3.38.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46425?
CVE-2026-46425 has a critical severity score of 9.9.
What vulnerability does CVE-2026-46425 describe?
CVE-2026-46425 describes a lack of role-based authorization in Budibase SCIM endpoints, allowing BASIC users to perform CRUD operations on tenant users.
How do I fix CVE-2026-46425?
To fix CVE-2026-46425, upgrade Budibase to version 3.38.2 or later which implements proper role checks for SCIM endpoints.
What impact does CVE-2026-46425 have on user data?
CVE-2026-46425 could allow unauthorized BASIC users to access, modify, or delete tenant user data due to inadequate authorization controls.
Is there a risk of data breaches with CVE-2026-46425?
Yes, CVE-2026-46425 poses a significant risk of data breaches as it allows improper access to sensitive user information.