CVE-2026-82240

Executive Summary

CVE-2026-82240 is a broken access control vulnerability in Budibase, a low-code application development platform, affecting all versions prior to 3.41.3. The flaw resides in the public user creation and update endpoints, where the application fails to enforce tenant-scoped authorization for app-level builder role assignments. An authenticated user possessing builder access to one application can submit crafted requests containing builder.apps fields to escalate their privileges, thereby gaining builder-level access to unrelated applications within the same tenant. Successful exploitation yields high impact on both confidentiality and integrity (CVSS 8.1) but does not affect availability. As of this writing, there is no evidence of active exploitation in the wild, no public proof-of-concept code, and the vendor has not issued a patch beyond the fixed version 3.41.3.

Technical Analysis

The root cause of CVE-2026-82240 is a failure to validate app-scoped builder role assignments in the public user management API endpoints of Budibase. The vulnerability class is CWE-862 (Missing Authorization), indicating that the application does not perform sufficient authorization checks prior to processing a request that modifies user roles or permissions.

Vulnerability Mechanism:
Budibase operates on a multi-tenant model where users can have varying levels of access across different applications. The platform distinguishes between global roles (e.g., admin, developer) and app-scoped roles (e.g., builder for a specific app). The public endpoints responsible for creating or updating user profiles accept a builder.apps field that specifies which applications the user should have builder access to. The flaw is that these endpoints do not perform cross-application authorization checks — they trust the requesting user's current builder privileges on one app and do not verify that the same user is authorized to grant builder access to other apps in the tenant.

From a code-level perspective, the authorization logic likely checks whether the authenticated user has an app-builder role globally (or for any app) but fails to enumerate the specific applications the requester is permitted to modify. As a result, an attacker who legitimately holds builder rights on Application A can send a crafted PUT request to the user update API, populating the builder.apps array with Application B's ID or name. The server processes this request without validating that the requester has administrative or builder privileges over Application B.

Attack Surface:
The vulnerable attack surface is the public-facing HTTP API endpoints used for user management. Because these endpoints are "public" in the Budibase architecture, they are accessible over the network without requiring prior administrative access — only standard authentication. The vulnerability is remotely exploitable (AV:N), requires low attack complexity (AC:L), and only requires low-privilege credentials (PR:L). No user interaction is needed (UI:N).

Version Scope:
All Budibase versions prior to 3.41.3 are affected. The fixed version, 3.41.3, presumably adds validation logic to ensure that a user attempting to modify builder.apps assignments holds adequate privileges over the target applications. Specific technical details of the patch (e.g., the exact code change or commit hash) are not publicly documented at the time of writing.

Exploitation Scenarios

No public proof-of-concept or exploit code exists for CVE-2026-82240 at the time of this report. The following attack chain is inferred from the NVD description and the vulnerability class.

Step 1 — Reconnaissance and Target Identification:
An attacker with valid credentials for Budibase (even low-privilege ones) enumerates the tenant's application list. In Budibase, the API or UI may reveal a list of applications within the tenant, exposing their identifiers (UUIDs or slugs). The attacker identifies target applications — high-value internal tools, customer-facing apps, or those containing sensitive data — for which they do not currently hold builder access.

Step 2 — Flaw Trigger:
The attacker authenticates to the Budibase instance and identifies the user management API endpoint (the "public user create/update endpoint"). They craft a request that modifies their own user object, specifically targeting the builder.apps field. Instead of specifying the app they currently have builder access to (e.g., a placeholder or test app), they insert the identifier of the target application into this field.

Step 3 — Payload/Execution (Vulnerability-Class Level):
At the vulnerability-class level, this is an unauthorized privilege escalation via crafted API input. The request submitted to the user update endpoint contains extended builder.apps fields beyond what the attacker's current permissions should allow. Because the server lacks authorization validation for the target app enumerated in the payload, it processes the request and updates the attacker's user profile with the elevated app-scoped builder role. The attack does not require injecting malicious code or exploiting memory corruption — it is purely a logic/authorization flaw.

Step 4 — Post-Exploitation Impact:
Once the attacker's user account has builder access to the target application, they can:

• View/modify the application's design, including page layouts, backend logic, and data connectors (confidentiality impact).
• Modify application data models, backend automations, or embed malicious scripts into the application that execute in the context of other legitimate end users (integrity impact).
• Potentially pivot from builder access to tenant-level admin privileges if the application has misconfigured admin role assignments or if additional escalation paths exist.

The impact is limited to a single tenant (attacker cannot cross tenant boundaries), but within that tenant, the attacker can compromise multiple application environments, achieving a broad blast radius.

Inference Caveat: No public PoC is available; this attack chain is derived from the vulnerability description and class. Specific endpoint paths, HTTP verbs, and payload formats beyond builder.apps are not publicly disclosed.

Impact Assessment

CVSS Analysis: The vulnerability carries a CVSS v3.1 score of 8.1 (High) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. The high confidentiality and integrity impact reflect the ability to read and modify data across multiple applications without authorization. Availability is not impacted — the attacker cannot cause denial of service through this flaw. The low privilege requirement (PR:L) and no user interaction make this an attractive target for malicious insiders or attackers with compromised low-level credentials.

Business Impact:

• Confidentiality breach: Sensitive data within Budibase-built applications may be exposed to unauthorized users with builder access, including customer PII, financial records, or proprietary business logic.
• Integrity compromise: Attackers can modify application logic, inject malicious content, or alter data workflows, potentially damaging application availability (indirectly), corrupting data integrity, or eroding customer trust.
• Lateral movement enabler: Builder access to one app often implies access to shared data stores or backend services; thus, this flaw can be a stepping stone for deeper infrastructure compromise.

Blast Radius: The vulnerability affects a single tenant's application ecosystem. Since Budibase is often self-hosted and deployed on-premises or in private clouds, an exploited instance may also serve as a pivot point to internal corporate networks. In multi-tenant SaaS deployments of Budibase, isolation between tenants should contain the damage, but tenant-wide compromise is achievable.

Affected Systems: All Budibase installations running versions prior to 3.41.3, including on-premises deployments, cloud-hosted instances, and official Budibase Cloud offerings (until upgraded).

Detection Guidance

The following detection rules target anomalous user update/creation requests containing builder.apps fields with unexpected application identifiers, privilege escalation attempts, and unauthorized role changes.

Sigma Rule

title: Budibase Unauthorized Builder Role Assignment
id: 8f3a7c21-9b2e-4d5f-8a6b-3c1e9f2d7a41
status: experimental
description: Detects crafted requests to Budibase user update/create endpoints that assign builder access to applications without proper authorization.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-82240
author: Valtersit Threat Intelligence
date: 2026/02/15
logsource:
    category: application
    product: budibase
    definition: 'Requires application-level audit logging of API requests and user profile modifications.'
detection:
    selection:
        event.action:
            - 'user.create'
            - 'user.update'
        request.body|contains: 'builder.apps'
        # Example IOCs: presence of application IDs different from the user's current scope
        # May require additional context - e.g., comparing to baseline allowed apps
    condition: selection
fields:
    - user.id
    - source.ip
    - request.body
falsepositives:
    - Legitimate admin operations assigning builder roles
    - System maintenance scripts updating user roles
level: medium

YARA Rule

rule budibase_priv_escalation_builder_apps
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTTP request payloads attempting to exploit CVE-2026-82240 in Budibase"
        reference = "CVE-2026-82240"
        date = "2026-02-15"
        score = 60

    strings:
        $s1 = "builder.apps" ascii nocase
        $s2 = "user/update" ascii nocase
        $s3 = "user/create" ascii nocase
        $s4 = "appId" ascii nocase
        $s5 = "role" ascii nocase
        $s6 = "\"builder\"" ascii nocase

    condition:
        (uint16(0) == 0x5A4D or uint16(0) == 0x4D5A) or filesize < 50KB
        and any of ($s1, $s2, $s3)
        and any of ($s4, $s5)
        and $s6
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82240 Budibase Unauthorized Builder Role Assignment Attempt"; flow:to_server,established; content:"builder.apps"; http_client_body; nocase; content:"user"; http_uri; nocase; pcre:"/(update|create)/i"; reference:cve,2026-82240; classtype:attempted-admin; sid:2500001; rev:1;)

Elastic Detection

sequence by user.id with maxspan=1m
  [ any where process.name == "nginx" or event.provider == "BudibaseApp" ]
  [ any where event.action in ("user.update", "user.create") and 
    request.body contains "builder.apps" and 
    request.body NOT contains source_user.allowed_builder_apps ]

Splunk SPL Query

index=budaudit sourcetype=budibase:api
| where like(request_body, "%builder.apps%")
| rename user.id as user_id
| join user_id [
    search index=budauth sourcetype=budibase:users
    | rename user.id as user_id, user.allowed_apps as allowed_apps
]
| where not match(request_body, allowed_apps)
| stats count by user_id, source_ip, request_body, _time
| sort _time desc

Wazuh OSSEC Rule

<group name="budibase,">
    <rule id="100824" level="12">
        <decoded as="json">event.action</decoded>
        <match>user.update|user.create</match>
        <match>builder.apps</match>
        <description>Budibase CVE-2026-82240: Attempted unauthorized builder role assignment via crafted user update/create request</description>
        <mitre>
            <id>T1098</id>
        </mitre>
        <group>access_control,</group>
        <options>no_full_log</options>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED in versions prior to 3.41.3 (no vendor patch released for older branches).

1) Immediate Mitigations (until upgrade)

• Upgrade to Budibase 3.41.3 — This is the only known fixed version. If your deployment is on a lower version, prioritize an upgrade immediately. The fixed version is presumed to add proper authorization validation for builder.apps assignments.
• Restrict network access — Limit access to the Budibase user management API endpoints to trusted IP ranges or VPN connections only. Do not expose these endpoints directly to the internet.
• Enforce least privilege — Audit all existing user accounts and remove builder-level access from any account that does not require it. Review permission assignments on a regular basis.
• Enable MFA — Require multi-factor authentication for all Budibase accounts, especially those with any app-builder or admin capabilities. This reduces the risk of credential compromise leading to exploitation.
• Monitor audit logs — Enable detailed audit logging for user management operations and review for anomalous builder.apps modifications. Use the detection rules above to alert on suspicious activity.

2) Patch/Upgrade Steps

• Backup — Take a full backup of the Budibase database and configuration files before upgrading.
• Upgrade — Follow the official Budibase upgrade documentation to migrate to version 3.41.3 or later. For Docker deployments, pull the updated image and restart containers.
• Post-upgrade validation — After the upgrade, confirm that user role assignment validation is enforced by attempting to perform an unauthorized cross-app builder assignment for a test user (if in a dev/staging environment). Verify access is denied.
• Re-audit roles — After patching, conduct a full audit of all user role assignments to ensure the vulnerability was not exploited prior to patching (i.e., look for users with unexpected builder.apps entries).

3) Long-Term Hardening

• Adopt zero-trust principles — Assume that any user account can be compromised; implement strong network segmentation between Budibase and other internal systems.
• Implement comprehensive API authorization — For self-hosted deployments, consider placing a reverse proxy or API gateway in front of Budibase to add an extra layer of authorization validation.
• Establish a patch management cadence — Subscribe to Budibase security advisories and apply patches within 48 hours for critical CVEs.
• Conduct regular penetration tests — Include Budibase in periodic internal security assessments to verify that authorization controls remain intact after configuration changes.
• Consider fine-grained access control via SSO — If using an external identity provider (e.g., SAML/OIDC), leverage group-based access control to minimize the attack surface of direct role assignment in Budibase.

No workarounds from the vendor are available; upgrading to 3.41.3 is the sole remediation path.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-82240
2. Budibase Official Site: https://budibase.com (vendor product page; advisory page not yet public)
3. CWE-862 (Missing Authorization): https://cwe.mitre.org/data/definitions/862.html
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-82240 not listed; no in-the-wild evidence)
5. MITRE ATT&CK — T1098 Account Manipulation: https://attack.mitre.org/techniques/T1098/

Threat Actor Campaigns: No known threat actor campaigns, exploit-in-the-wild activity, or ransomware usage associated with this CVE has been reported at the time of writing. This may change as the vulnerability becomes more widely known; monitor threat intelligence feeds for updates.