CVE-2026-73305

Executive Summary

CVE-2026-73305 is an improper privilege management vulnerability (CWE-269) in Budibase, an open-source low-code platform, affecting all versions prior to 3.39.24. The flaw exists in the global role validation logic used by the POST /api/public/v1/roles/assign endpoint, where the application fails to verify that the appBuilder.appId or role.appId matches the application context specified in the request. This allows an authenticated user with builder access to one application to escalate their privileges and either grant themselves builder access or assign arbitrary roles in a different application, thereby exposing sensitive data, datasource configurations, and automations belonging to other applications. With a CVSS score of 8.8 (High), this vulnerability poses a severe risk to multi-tenant Budibase deployments where users are scoped to specific applications.

Technical Analysis

The vulnerability resides in the server-side authorization component of Budibase's public API, specifically within the file packages/server/src/api/controllers/public/globalRoleValidation.ts. The affected endpoint, POST /api/public/v1/roles/assign, is designed to manage role assignments for users within the Budibase platform. The flaw occurs when the endpoint calls the validateGlobalRoleUpdate function, which is responsible for ensuring that the requesting user has sufficient permissions to perform the role assignment operation.

The core issue is a missing authorization check. The validateGlobalRoleUpdate function fails to verify that the appBuilder.appId property (which identifies the application scope of the authenticated builder user) matches the role.appId property (which identifies the application to which the role is being assigned). In a properly designed multi-tenant system, an application-scoped builder should only be able to modify roles within their own application. However, due to this missing check, an attacker who has builder-level access to one application can craft a request that:

1. Scopes the request with the appId of an application they legitimately control.
2. Targets the role.appId of a different, victim application.

Because the validation logic does not compare these two identifiers, the authorization check passes, and the role assignment is executed against the victim application. This constitutes a classic IDOR (Insecure Direct Object Reference) combined with improper privilege management—the system trusts the object identifiers provided in the request without verifying that the authenticated principal has legitimate authority over both objects.

The attack surface is the Budibase public REST API, which is typically exposed on port 80/443. The endpoint accepts JSON payloads containing role assignment requests. The vulnerability requires prior authentication with at least builder-level privileges in one application, which lowers the attack complexity to "Low" per the CVSS vector, as the attacker does not need to bypass authentication entirely—they only need to leverage their existing limited access to gain unauthorized elevated access elsewhere.

The consequence of successful exploitation is partial-to-complete compromise of the victim application's data confidentiality, integrity, and availability. The CVSS subscores reflect High impact across all three security dimensions (C:H/I:H/A:H), indicating that an attacker could read, modify, or destroy data within the victim application, access stored datasource credentials, and manipulate or disable automations.

Exploitation Scenarios

Reconnaissance and Target Identification: The attacker first identifies Budibase instances exposed to the internet. Using Shodan or similar search engines with queries such as http.title:"Budibase", the attacker locates deployed instances. Alternatively, organizational intelligence may reveal Budibase as part of the target's technology stack. The attacker then registers or is provisioned an account within the platform and obtains builder-level access to a low-value or decoy application—this is achievable because Budibase, like many low-code platforms, allows multiple applications to be hosted on a single instance, and user onboarding often grants initial limited access to a starter application.

Exploiting the Authorization Bypass: The attacker authenticates to the Budibase API and crafts a POST request to the /api/public/v1/roles/assign endpoint. The request body contains two application identifiers: the appBuilder.appId field set to the attacker's controlled application (to satisfy the builder-scope check) and the role.appId field set to the victim's application identifier. The role.roleId field specifies the role the attacker wishes to assign—typically a "builder" or "admin" role—and the userId field targets either the attacker's own account or a colluding account.

Because the server-side validateGlobalRoleUpdate function only verifies that the requesting user is a builder (without cross-checking the two application IDs), the request passes authorization validation. The server proceeds to assign the requested role in the victim application context.

Post-Exploitation Impact: With elevated privileges (e.g., builder or admin) in the victim application, the attacker gains full access to:

• Application data stored in the platform's database, including user records, business logic data, and any sensitive information processed by the application.
• Datasource configuration details, which may include connection strings, database credentials, API keys, and other secrets used to integrate with external systems.
• Automation definitions and execution logs, which could reveal workflow logic, embedded credentials, and PII processing patterns.

The attacker can then modify application logic, exfiltrate data, pivot to connected backend systems using leaked datasource credentials, or disrupt operations by tampering with automations. In a multi-tenant environment, this effectively breaks tenant isolation and compromises all applications accessible to the victim's scope.

Note: No public PoC is available; the attack chain is inferred from the vulnerability class (improper authorization/IDOR) as described in the NVD entry.

Impact Assessment

Business Impact: CVE-2026-73305 represents a critical authorization failure that breaks the fundamental multi-tenancy isolation guarantees of the Budibase platform. Affected organizations include any enterprise running Budibase version 3.39.23 or earlier with multiple applications scoped to different user groups, internal teams, or external clients. The vulnerability enables lateral privilege escalation across application boundaries, turning a low-privileged builder account into a high-privileged administrator of unrelated applications.

Affected Systems: All Budibase instances prior to version 3.39.24, regardless of deployment method (Docker, Kubernetes, cloud-hosted, or on-premises), are affected. The vulnerability is server-side and does not require specific client configuration to exploit. Any instance where the public API is accessible to authenticated users is at risk.

Blast Radius: The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates Network attack vector with Low complexity. An attacker only needs valid low-privileged credentials—no user interaction is required, and the scope is technically "Unchanged" (single system), but the practical impact extends across all applications hosted on that instance. The confidentiality, integrity, and availability impacts are all rated High, meaning an attacker can fully compromise the victim application's data and operations. For compliance-sensitive environments handling PII, financial data, or PHI, this vulnerability could constitute a reportable data breach. Additionally, exposed datasource credentials present a significant supply-chain risk, as they may grant access to external databases, cloud storage, or third-party SaaS services.

Detection Guidance

The following detection rules are designed to identify exploitation attempts of CVE-2026-73305. They focus on anomalous role assignment activity, cross-application access patterns, and privilege escalation behavior.

Sigma Rule

title: Budibase Cross-Application Role Assignment Attempt
id: a7f3c9e2-5b8d-4e1a-9c3f-7d2e8b4a1f06
status: experimental
description: Detects attempts to assign roles across application boundaries in Budibase, indicating potential exploitation of CVE-2026-73305.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73305
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: application
    product: budibase
detection:
    selection:
        http.method: POST
        http.url.path: /api/public/v1/roles/assign
        http.response.status_code: 200
        cs.username: present
    filter_known_good:
        http.url.query.appId: same as role.appId
    condition: selection and not filter_known_good
level: high
falsepositives:
    - Legitimate cross-application role management by global administrators
    - Misconfigured API integrations that assign roles across apps
fields:
    - cs.username
    - http.url
    - http.response.body
    - src.ip

YARA Rule

rule CVE_2026_73305_Budibase_Role_Assign_Payload
{
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2026-01-15"
        description = "Detects YARA content matching exploitation payloads for CVE-2026-73305 Budibase privilege escalation"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73305"
        severity = "high"
    strings:
        $endpoint = "/api/public/v1/roles/assign" ascii wide
        $role_field = "\"roleId\"" ascii wide
        $app_builder = "\"appBuilder\"" ascii wide
        $role_assign = "\"appId\"" ascii wide
        $builder_role = "\"BUILDER\"" ascii wide
        $admin_role = "\"ADMIN\"" ascii wide
    condition:
        uint16(0) == 0x5B7B or uint16(0) == 0x7B7B and
        $endpoint and $role_field and $app_builder and $role_assign and
        (1 of ($builder_role, $admin_role))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-73305 Budibase Cross-Application Role Assignment Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/api/public/v1/roles/assign"; nocase; http.request_body; content:"roleId"; nocase; content:"appBuilder"; nocase; content:"appId"; nocase; pcre:"/\"appId\"\s*:\s*\"[^\"]+\".*\"roleId\"\s*:\s*\"[^\"]+\"/s"; classtype:attempted-admin; sid:2026073305; rev:1; metadata:created_at 2026_01_15, updated_at 2026_01_15, cve CVE-2026-73305;)

Elastic Detection

sequence by user.name with maxspan=5m
  [network where destination.port == 443 and
   http.request.method == "POST" and
   http.request.uri == "/api/public/v1/roles/assign" and
   http.response.status_code == 200]
  [any where
   // Flag abnormal privilege escalation patterns
   user.name != "admin" and
   // Look for rapid successive role assignments to different appIds
   event.action in ("role_assign", "user_update")]

Splunk SPL Query

index=budibase sourcetype=budibase:api
| where method="POST" AND uri_path="/api/public/v1/roles/assign" AND status=200
| spath input=request_body
| eval appId = mvindex(json_extract(request_body, "appBuilder.appId"), 0), roleApp = mvindex(json_extract(request_body, "role.appId"), 0)
| where appId != roleApp
| table _time, src_ip, user, appId, roleApp, roleId, http_status
| sort -_time

Wazuh OSSEC Rule

<group name="budibase,">
  <rule id="100733" level="14">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <field name="url">/api/public/v1/roles/assign</field>
    <field name="response">200</field>
    <description>Budibase CVE-2026-73305: Cross-application role assignment detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>budibase,privilege-escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source).

Immediate Mitigations:

1. Upgrade to Patched Version: The only reliable mitigation is upgrading Budibase to version 3.39.24 or later, where the validateGlobalRoleUpdate function properly validates both appBuilder.appId and role.appId prior to role assignment. Monitor the official Budibase release channels for the security advisory.
2. Restrict Public API Access: If immediate upgrade is not feasible, restrict access to the public API endpoint by placing it behind a reverse proxy that enforces additional authentication or IP allowlisting. Consider disabling the public API entirely in environments where it is not required.
3. Audit Existing User Roles: Conduct an immediate audit of all user role assignments across applications to identify any unauthorized privilege grants. Look for builder/admin roles assigned to users who should not hold them, especially in shared tenant deployments.
4. Review Application Logs: Analyze Budibase application logs for anomalous role assignment activity, particularly requests to /api/public/v1/roles/assign where the appBuilder.appId and role.appId differ.

Patch/Upgrade Steps:

1. Identify the current Budibase version: docker exec <container> budibase --version or check the container image tag.
2. Pull the latest patched version: docker pull budibase/budibase:latest (ensure it is ≥ 3.39.24).
3. Back up critical data (Budibase SQLite/CouchDB data directories) before upgrading.
4. Follow official Budibase upgrade documentation to apply the update with minimal downtime.
5. Re-test role assignment functionality across multiple applications to verify proper isolation.

Long-Term Hardening:

1. Implement network segmentation so that Budibase instances are not directly exposed to the internet unless strictly required; use VPN or bastion hosts.
2. Enforce least-privilege role assignments at the platform administration level, ensuring users are only granted builder access when explicitly required.
3. Enable comprehensive audit logging on all API calls and integrate logs with a SIEM for continuous monitoring.
4. Subscribe to Budibase security advisories and the project's GitHub releases to stay abreast of future patches.
5. Consider implementing a web application firewall (WAF) rule to block requests matching the exploitation pattern described in the detection rules above.

References

1. NVD Entry for CVE-2026-73305: https://nvd.nist.gov/vuln/detail/CVE-2026-73305
2. Budibase Official Website: https://budibase.com/
3. Budibase GitHub Repository: https://github.com/Budibase/budibase
4. CWE-269 Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
5. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

There is no evidence of active exploitation in the wild or known threat actor campaigns targeting this vulnerability at the time of this report. However, given the CVSS score and the relatively straightforward exploitation mechanism, organizations running affected versions should treat this as a high-priority risk.