CVE-2026-82240: Budibase before 3.41.3 Privilege Escalation via User Update API
Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps fields to escalate privileges and gain unauthorized builder access to other applications in the same tenant.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.41.3 - Compensating control
If you cannot upgrade immediately, restrict/limit access to the Budibase public user create and update endpoints so that authenticated app-scoped builders cannot grant builder role assignments outside their app scope.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with an app-scoped builder role can exploit it. The impact is limited to gaining builder access to unrelated applications within the same tenant.
What access or interaction is required for exploitation?
The attacker needs valid authentication as an app-scoped builder and must be able to send crafted requests to the public user update API. No user interaction is required.
Which deployments are affected?
Budibase versions before 3.41.3 are affected. The vulnerable behavior is in the public user create and update endpoints when processing app-scoped builder role assignments.
What is the remediation?
Upgrade Budibase to version 3.41.3 or later. This version addresses validation of app-scoped builder role assignments.