Vertical Privilege Escalation and IDOR in Budibase Low Code Platform

CVE-2026-25045

What is CVE-2026-25045?

Budibase, a low code platform designed for creating internal tools, is exposed to a vulnerability that allows a Creator-level user to manipulate user roles and account details improperly. Due to insufficient role-based access controls (RBAC) in the /api/global/users endpoints, a Creator can elevate the privileges of an App Viewer to a Tenant Admin, or even change the Owner’s account information. This occurs because the API does not validate the requesting user's role, allowing for abuse of session tokens and leading to severe security implications, including the potential for complete tenant compromise. It is essential for users and administrators of Budibase to evaluate their security postures and apply necessary updates to mitigate these risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References