CVE Feed

    Dashboard / CVE / CVE-2026-100686

    CVE-2026-100686

    Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant themselves admin roles in other workspaces by modifying user group role mappings.

    Published:Sep 26, 2026
    Last Modified:Sep 30, 2026
    EPS:Sep 26, 2026
    EPSS Score:0.00209
    CVSS Score:8.1

    Affected Products

    Vendor
    Budibase
    Product
    Server

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-269 Improper Privilege Management

    Related CVEs

    CVE-2026-100688 (CVSS 7.1) — Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/app…
    CVE-2026-100687 (CVSS 7) — Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external ta…
    CVE-2026-100685 (CVSS 8.3) — Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builder…
    CVE-2026-100684 (CVSS 9.2) — Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibas…
    CVE-2026-100683 (CVSS 8.9) — Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/sr…
    CVE-2026-100682 (CVSS 8.7) — Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint t…
    CVE-2026-100681 (CVSS 6.3) — Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vul…
    CVE-2026-100680 (CVSS 8.6) — Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger impo…
    CVE-2026-82246 (CVSS 7.1) — Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoin…
    CVE-2026-82245 (CVSS 7.2) — Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High