CVE-2026-100686 Overview
CVE-2026-100686 is a cross-workspace privilege escalation vulnerability in Budibase versions before 3.45.0. The flaw resides in the POST /api/global/groups/:groupId/apps endpoint, which fails to validate per-app authorization. A builder scoped to a single workspace can modify user group role mappings to assign themselves administrative roles in workspaces they do not own. The weakness maps to [CWE-269: Improper Privilege Management]. Exploitation requires only authenticated builder-level access and no user interaction.
Critical Impact
An authenticated builder in one workspace can escalate to administrator across other workspaces, compromising confidentiality and integrity of applications they were never granted access to.
Affected Products
- Budibase versions prior to 3.45.0
- Self-hosted Budibase deployments using multi-workspace tenancy
- Cloud-hosted Budibase instances sharing the vulnerable API surface
Discovery Timeline
- 2026-09-26 - CVE-2026-100686 published to NVD
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-100686
Vulnerability Analysis
Budibase organizes applications into workspaces, and user groups bind roles to specific applications. The POST /api/global/groups/:groupId/apps endpoint accepts a mapping of application IDs to role names, allowing group administrators to adjust role assignments.
The endpoint validates that the caller holds builder privileges but does not confirm that the caller is a builder of each application referenced in the request body. An attacker who is a builder of one workspace can submit a request specifying application IDs belonging to other workspaces along with elevated role names such as ADMIN.
Once the group mapping is updated, membership in that group grants the attacker the assigned role across every targeted application. This yields read, write, and administrative control over applications outside the attacker's original authorization boundary.
Root Cause
The root cause is missing per-resource authorization enforcement [CWE-269]. The endpoint checks a coarse-grained builder role but omits a verification step that the authenticated principal has builder rights for each application ID supplied in the payload. This creates a horizontal and vertical privilege escalation path across tenancy boundaries within the same Budibase deployment.
Attack Vector
Exploitation is remote and requires low privileges. The attacker authenticates as any workspace builder, identifies target application IDs through enumeration or shared tenant metadata, and issues a crafted POST request to /api/global/groups/:groupId/apps referencing those IDs. The server accepts the mapping without cross-checking workspace ownership, after which the attacker inherits administrative rights on the targeted applications. No social engineering or victim interaction is required. See the GitHub Security Advisory GHSA-pp5r-q4fp-mcj3 for additional technical context.
Detection Methods for CVE-2026-100686
Indicators of Compromise
- Unexpected POST requests to /api/global/groups/:groupId/apps originating from builder accounts scoped to a single workspace.
- User group role mappings that reference application IDs outside the group's historical scope.
- Sudden appearance of new ADMIN role bindings in audit logs for builders who were previously limited to one workspace.
Detection Strategies
- Correlate the authenticated principal in API logs against the workspace ownership of each application ID in the request body.
- Alert on any role assignment that crosses workspace boundaries within a single API call.
- Baseline normal group-to-app role mapping changes and flag deviations in volume or scope.
Monitoring Recommendations
- Enable verbose API access logging on the Budibase global service and ship logs to a centralized analytics platform.
- Monitor privileged role assignments and administrator additions across all workspaces continuously.
- Review audit trails for group mutations following any builder account creation or credential reset.
How to Mitigate CVE-2026-100686
Immediate Actions Required
- Upgrade all Budibase instances to version 3.45.0 or later without delay.
- Audit user group memberships and application role mappings for unauthorized cross-workspace assignments.
- Revoke and reissue credentials for builder accounts that may have been abused prior to patching.
Patch Information
Budibase addressed the issue in version 3.45.0 by enforcing per-app authorization checks within the POST /api/global/groups/:groupId/apps handler. Details are documented in the GitHub Security Advisory GHSA-pp5r-q4fp-mcj3 and the VulnCheck Advisory.
Workarounds
- Restrict network access to the Budibase global API to trusted administrators until the upgrade is applied.
- Temporarily limit builder role grants and require administrator approval for any group role mapping changes.
- Isolate sensitive workspaces into separate Budibase tenants to reduce the blast radius of a successful exploit.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
