CVE-2026-100686

Executive Summary

CVE-2026-100686 is a broken authorization vulnerability in Budibase versions before 3.45.0, where the POST /api/global/groups/:groupId/apps endpoint fails to enforce per-application authorization. Any authenticated user with builder privileges in a single workspace can modify user group role mappings to grant themselves administrative roles in other workspaces. The vulnerability carries a CVSS 3.1 base score of 8.1 (High) and has no public proof-of-concept or exploit code available at the time of writing.

Technical Analysis

Budibase is a low-code platform for building internal applications, organized around the concept of "workspaces" (also referred to as apps), each with its own user groups and role assignments. Authorization is expected to be scoped per-application, meaning a builder in workspace A should not be able to influence role assignments or group memberships in workspace B.

The flaw resides in the POST /api/global/groups/:groupId/apps endpoint. Per the NVD description, this endpoint accepts a request that assigns application-level roles via user group role mappings, but fails to validate that the calling user possesses the necessary authorization for the target application(s). The groupId is supplied as a path parameter and the role mappings are supplied in the request body, but the server does not verify that the authenticated principal has legitimate administrative authority over the applications referenced in that mapping.

The result is a horizontal-to-vertical privilege escalation chain. Because group role mappings are the mechanism by which Budibase determines a user's effective permissions inside a workspace, an attacker who can write to those mappings can elevate their own effective role within a foreign workspace. The vulnerability class is CWE-269 (Improper Privilege Management), specifically missing authorization on a privileged state-changing endpoint.

Key technical characteristics:

• Attack vector: Network (AV:N), fully remote.
• Attack complexity: Low (AC:L) — no special conditions or race windows are required.
• Privileges required: Low (PR:L) — the attacker only needs an ordinary builder account in at least one workspace.
• User interaction: None (UI:N).
• Scope: Unchanged (S:U) — the vulnerable component (Budibase) remains the impacted security authority.
• Confidentiality and Integrity impact: High (C:H/I:H) — arbitrary role escalation grants read access to foreign-workspace data and the ability to modify applications and their content.
• Availability impact: None (A:N) as scored.

The absence of a scope change indicates that while the attacker crosses a logical tenant boundary (workspace-to-workspace), the underlying platform authorization model is what is being subverted — the trust boundaries are application-defined rather than enforced by a separate security authority. This is a classic missing-function-level-authorization (per-object authorization) defect: the endpoint authenticates the caller but never authorizes the caller against the specific target resource.

No public source code, commit hash, or advisory fix reference was available in the tracked intelligence sources at the time of analysis, so code-level implementation details of the fix cannot be described. All statements above are derived strictly from the NVD description.

Exploitation Scenarios

The following attack chain is described at the vulnerability-class level, because no public exploit code exists. Details are limited to the endpoint and mechanism explicitly named in the NVD description; no additional endpoints, parameters, or function names are asserted.

1. Reconnaissance / target identification. The attacker holds a legitimate, low-privileged builder account in at least one Budibase workspace (or is able to obtain one). They enumerate workspace/application identifiers and user group identifiers to identify a target workspace whose groups they wish to subvert. Group identifiers are referenced in the vulnerable endpoint path, so the attacker needs a groupId value that belongs to the target application. These may be observable through the platform's own UI/API responses to an authenticated user.

2. Triggering the flaw class. The attacker issues an authenticated HTTP request to POST /api/global/groups/:groupId/apps, substituting the groupId of a group within a foreign workspace. The request body contains a role mapping that assigns a role (for example, an admin-level application role) to the attacker's own user within that group. Because the endpoint performs authentication of the caller but omits the per-app authorization check, the request is accepted even though the caller has no legitimate authority over the target workspace.

3. Payload / execution method (class level). The "payload" is a state-changing role-mapping assignment submitted as an authenticated API call. The attacker does not need to supply malformed input, exploit memory corruption, or bypass authentication — they merely supply a valid, well-formed authorization-mutating request to an endpoint that never checks whether they are allowed to make it. No public PoC is available; this chain is inferred from the vulnerability class (missing object-level authorization on a privileged endpoint).

4. Post-exploitation impact. Once the role mapping is written, the attacker's effective permissions within the foreign workspace are elevated to whatever role they assigned themselves. From there, they gain High-impact read (Confidentiality) and write (Integrity) capabilities over that workspace's applications and data — viewing sensitive internal applications, altering application definitions, and modifying records. Because the change is a persistent role-mapping modification, the elevated access survives beyond the initial request until administrators review and correct the group's role assignments.

Impact Assessment

• Confidentiality (High). Successful escalation grants cross-workspace read access to applications and their underlying data — a tenant-isolation failure that can expose sensitive internal business data aggregated across multiple teams or business units.
• Integrity (High). The attacker can modify applications and their content within foreign workspaces, enabling data tampering and potentially persistent malicious content injection into other teams' apps.
• Availability (None per score). The vulnerability as scored does not directly degrade availability, though an attacker with elevated write access could conceivably disrupt foreign applications — this is not reflected in the CVSS availability subscore.
• Blast radius. The blast radius spans all workspaces reachable from the vulnerable instance where group identifiers can be referenced. In multi-tenant or multi-team Budibase deployments, this breaks the tenant boundary between every workspace on the same Budibase server. The requirement for only low privileges (a single builder account) makes this trivial to trigger for any insider or any user who has been granted limited builder access.
• Business impact. Organizations using Budibase for internal tooling should assume that any builder account is a potential vector for full cross-workspace compromise. The persistent nature of the role-mapping change means remediation requires auditing and reverting group role assignments, not just blocking a request in flight.

Detection Guidance

Detection for this vulnerability centers on monitoring the POST /api/global/groups/:groupId/apps endpoint for requests originating from users who do not legitimately administer the referenced group/application, and on alerting to unexpected changes in role mappings.

Sigma Rule

title: Budibase Missing Per-App Authorization Role Mapping Abuse (CVE-2026-100686)
id: 7b1e6c9a-2f4d-4d1e-9a3b-1c0e5f6a8d21
status: experimental
description: Detects POST requests to the Budibase groups/:groupId/apps endpoint that assign application roles, indicative of missing per-app authorization abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100686
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: budibase
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains: '/api/global/groups/'
  selection_uri_apps:
    cs-uri-stem|endswith: '/apps'
  condition: selection_method and selection_uri and selection_uri_apps
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
falsepositives:
  - Legitimate administrators assigning roles to their own workspace groups
level: medium

YARA Rule

rule CVE_2026_100686_Budibase_RoleMap_Abuse
{
    meta:
        author = "valtersit.com"
        description = "Detects HTTP requests targeting the Budibase global groups apps endpoint (CVE-2026-100686)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100686"
        date = "2026-01-01"

    strings:
        $ep1 = "POST /api/global/groups/" ascii wide nocase
        $ep2 = "/api/global/groups/" ascii wide nocase
        $apps = "/apps" ascii wide nocase

    condition:
        (uint16(0) == 0x4854 or uint32(0) == 0x2f2f3a48 or $ep1) and
        any of ($ep*) and $apps
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100686 Budibase Missing Per-App Authorization Role Mapping Abuse"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/global/groups/"; http.uri; content:"/apps"; nocase; classtype:attempted-admin; reference:cve,CVE-2026-100686; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100686; sid:2026100686; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ network where http.request.method == "POST" and
      http.request.uri : "/api/global/groups/*" and
      http.request.uri : "*/apps*" ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=stream:http
| eval uri=coalesce(uri, url)
| where match(uri, "(?i)^/api/global/groups/[^/]+/apps")
| where method="POST" OR http_method="POST"
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as status_codes by src_ip, user, uri
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,budibase,">
  <rule id="100686" level="10">
    <if_sid>31100</if_sid>
    <id>^31103$</id>
    <match>POST</match>
    <regex type="pcre2">(?i)/api/global/groups/[^/]+/apps</regex>
    <description>CVE-2026-100686: Possible Budibase per-app authorization bypass via role mapping (POST /api/global/groups/:groupId/apps)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>cve_2026_100686,privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Restrict access to the vulnerable endpoint at the reverse proxy or API gateway. Where feasible, block or tightly allow-list POST /api/global/groups/:groupId/apps so that only trusted administrative principals can reach it.
   • Enforce strict network segmentation of the Budibase instance so it is not reachable by broad internal user populations; only builders who genuinely require it should have network access.
   • Audit existing user group role mappings across all workspaces for role assignments that exceed the assigning user's legitimate authority. Since a successful exploit writes a persistent mapping, remediation must include reverting any suspicious escalations.
   • Reduce the population of builder accounts to the minimum necessary, since the exploit requires only a single builder account.

2. Patch/upgrade steps.

   • Apply the fix by upgrading Budibase to version 3.45.0 or later, as indicated by the NVD description ("versions before 3.45.0"). No vendor advisory, commit reference, or CVE-specific patch source was available in the tracked intelligence feeds, so confirm the fixed version directly against the Budibase release channel before relying on it.
   • After upgrading, re-audit group role mappings and revoke any roles that cannot be justified.

3. Long-term hardening.

   • Implement and enforce object-level/per-application authorization checks on every state-changing endpoint, not just authentication checks. Authorization must be validated against the specific target resource (group, app, workspace), not merely the caller's identity.
   • Adopt centralized authorization middleware so new endpoints cannot ship without resource-scoped permission enforcement.
   • Continuously monitor and alert on role/permission mapping changes, particularly from builder-tier accounts, and treat cross-workspace role grants as high-severity events.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100686
• CWE-269 Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
• MITRE ATT&CK T1068 Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• Budibase project: https://budibase.com

No public proof-of-concept, exploit code, Nuclei template, or CISA KEV listing was identified for this CVE. No threat actor campaign or exploit-in-the-wild evidence is available at the time of writing.