CVE-2026-73301: Budibase Information Disclosure Flaw

CVE-2026-73301 Overview

CVE-2026-73301 is a missing authorization vulnerability in Budibase, an open-source low-code platform. The flaw affects the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts. Prior to version 3.39.25, the route omitted the auth.builderOrAdmin middleware. Any authenticated user holding the BASIC role could enumerate tenant groups, role mappings, user memberships, builder permissions, and default-group flags. This exposes the tenant access-control structure to non-privileged accounts. The issue is categorized as [CWE-862] Missing Authorization and is fixed in Budibase 3.39.25.

Critical Impact
Authenticated BASIC-role users can enumerate tenant group structures, role mappings, and user-to-group memberships, disclosing the tenant's access-control topology to unprivileged accounts.

Affected Products

Budibase versions prior to 3.39.25
Budibase Worker component (packages/worker)
Self-hosted and cloud deployments running vulnerable releases

Discovery Timeline

2026-08-12 - CVE-2026-73301 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73301

Vulnerability Analysis

The vulnerability resides in the Budibase worker service, which brokers global tenant operations including user groups. The router definition for GET /api/global/groups chained the proMiddleware.feature.requireFeature(Feature.USER_GROUPS) guard and the fetch controller, but omitted the auth.builderOrAdmin middleware present on comparable administrative routes.

As a result, the endpoint only verified that the caller held a valid session, not that the caller had builder or administrator privileges. A user with the lowest privilege tier, BASIC, could issue an authenticated request and receive the complete group inventory for the tenant.

The returned payload includes group identifiers, role mappings that show which application roles are assigned to which groups, user memberships that reveal who belongs to each group, builder permission flags, and default-group markers. This information maps the tenant's access-control graph and helps attackers identify high-value accounts and privileged groups for follow-on targeting.

Root Cause

The root cause is a missing authorization check on a sensitive administrative route [CWE-862]. The auth.builderOrAdmin middleware, which enforces builder or administrator role membership, was not applied to the group-listing handler.

Attack Vector

Exploitation requires only network access to the Budibase worker API and valid credentials for any BASIC-role tenant user. The attacker authenticates, issues a single GET /api/global/groups request, and parses the JSON response to enumerate the tenant's group structure. No user interaction or elevated privileges are needed.

typescript

// Security patch in packages/worker/src/api/routes/global/groups.ts
// Adds the missing builderOrAdmin authorization check
   )
   .get(
     "/api/global/groups",
+    auth.builderOrAdmin,
     proMiddleware.feature.requireFeature(Feature.USER_GROUPS),
     controller.fetch
   )

Source: GitHub Commit 93db778

Detection Methods for CVE-2026-73301

Indicators of Compromise

Successful GET /api/global/groups HTTP 200 responses originating from user sessions that are not associated with builder or administrator accounts.
Repeated or scripted requests to /api/global/groups from a single BASIC-role session within a short time window.
Unexpected outbound transfer of large JSON payloads from the Budibase worker service to end-user IP ranges.

Detection Strategies

Parse Budibase worker access logs and correlate requests to /api/global/groups against the requester's role attribute; alert on any non-builder, non-admin access.
Add a WAF or reverse-proxy rule that logs and tags requests to global administrative endpoints for later review.
Baseline normal request volume to /api/global/groups per tenant and alert on statistical anomalies.

Monitoring Recommendations

Ingest Budibase worker and reverse-proxy logs into a centralized SIEM or data lake for role-aware querying.
Monitor Budibase release notes and the GitHub Security Advisory GHSA-4qcj-m5wp-jmf4 for related disclosures.
Review authentication audit trails for BASIC-role accounts that exhibit administrative-endpoint reconnaissance patterns.

How to Mitigate CVE-2026-73301

Immediate Actions Required

Upgrade all Budibase deployments to version 3.39.25 or later without delay.
Audit tenant user rosters and revoke BASIC accounts that are no longer required.
Review recent access logs for /api/global/groups calls from non-builder sessions and treat matches as reconnaissance.

Patch Information

The fix is available in Budibase release 3.39.25, landed via Pull Request #19109 and commit 93db778. The patch adds the auth.builderOrAdmin middleware to the GET /api/global/groups route so only builders and administrators can enumerate groups. Refer to the GitHub Security Advisory GHSA-4qcj-m5wp-jmf4 for the official disclosure.

Workarounds

Restrict access to the Budibase worker API using a reverse proxy or WAF that blocks /api/global/groups for non-administrative sessions until the upgrade is applied.
Temporarily disable the User Groups feature (Feature.USER_GROUPS) if operational requirements permit, since the guarded middleware will short-circuit the request.
Rotate credentials for any BASIC-role account observed calling the endpoint prior to remediation.

bash

# Example nginx rule to restrict the vulnerable endpoint pre-patch
location = /api/global/groups {
    if ($request_method = GET) {
        # Allow only requests from trusted admin networks
        allow 10.0.0.0/24;
        deny all;
    }
    proxy_pass http://budibase-worker;
}