CVE-2026-82240
Budibase before 3.41.3 Privilege Escalation via User Update API
- State
- Published
- Severity
- 8.6 High
- Published
- Aug 28, 2026
- Updated
- Oct 8, 2026
- Reserved
- Aug 28, 2026
Description
Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps fields to escalate privileges and gain unauthorized builder access to other applications in the same tenant.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
serverbudibase |
|
References
- GitHub Security Advisory (GHSA-468g-55qj-v8rr)vendor-advisory
- VulnCheck Advisory: Budibase before 3.41.3 Privilege Escalation via User Update APIthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.