Role Assignment Flaw in Budibase Low-Code Platform

CVE-2026-73305

What is CVE-2026-73305?

Budibase, an open-source low-code platform, contains a vulnerability in its role assignment functionality. In versions prior to 3.39.24, the endpoint responsible for role assignments did not adequately verify the application context, allowing an app-scoped builder to exploit the system. This flaw enables unauthorized users to elevate their privileges by granting themselves builder access or arbitrary roles within applications they do not own. Consequently, sensitive data, data source configurations, and automations from other apps could be exposed, raising significant security concerns.

References