CVE-2026-82245: Budibase before 3.41.3 Missing Authorization License Management
Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Attackers with basic user privileges can access /api/global/license/ endpoints to disable premium features and downgrade deployments for all users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.41.3Patch Missing Authorization License Management - Compensating control
Restrict external access to Budibase license management endpoints under /api/global/license/* (e.g., allow only trusted admin/UI clients or trusted IPs) until the instance is upgraded to 3.41.3 or later.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Budibase user with basic user privileges can access the affected license management endpoints. No user interaction is required.
Which deployments are affected?
Budibase deployments running versions before 3.41.3 are affected. The exposed endpoints are under /api/global/license/*.
What could an attacker do?
An attacker can delete license keys or manipulate offline tokens, which can disable premium features and downgrade the deployment for all users.
What is the immediate mitigation if upgrading is not possible?
The provided information does not identify a workaround. Restrict access to affected endpoints and limit authenticated access to trusted users until Budibase can be updated to 3.41.3 or later.