CVE-2026-73301: Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder permissions, and default-group flags. The disclosure exposes the tenant access-control structure to users who are not builders or administrators. This issue is fixed in version 3.39.25.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.39.25
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73301?
The severity of CVE-2026-73301 is categorized as medium with a score of 4.3.
What does CVE-2026-73301 affect?
CVE-2026-73301 affects the Budibase low-code platform, specifically prior to version 3.39.25.
How does CVE-2026-73301 pose a risk?
CVE-2026-73301 allows authenticated BASIC role users to enumerate tenant groups and role mappings due to missing RBAC on the GET /api/global/groups endpoint.
How can I mitigate CVE-2026-73301?
To mitigate CVE-2026-73301, ensure that Budibase is updated to version 3.39.25 or later.
Who is affected by CVE-2026-73301?
CVE-2026-73301 affects users of Budibase with basic user roles who can exploit the vulnerability to access sensitive information.