CVE-2026-82240 Overview
CVE-2026-82240 is a privilege escalation vulnerability in Budibase, a low-code platform for building internal business applications. Versions before 3.41.3 fail to validate app-scoped builder role assignments in the public user create and update endpoints. An authenticated app-scoped builder can submit crafted requests containing builder.apps fields to grant themselves builder access to unrelated applications in the same tenant. The flaw is classified as Missing Authorization [CWE-862] and stems from broken access control in the user management API.
Critical Impact
An authenticated builder scoped to a single application can escalate privileges and gain builder-level access to any other application within the same tenant, exposing application code, data connections, and business logic.
Affected Products
- Budibase versions prior to 3.41.3
- Self-hosted Budibase deployments
- Multi-tenant Budibase installations with app-scoped builder roles
Discovery Timeline
- 2026-08-28 - CVE-2026-82240 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-82240
Vulnerability Analysis
Budibase supports two builder role types: global builders with tenant-wide privileges, and app-scoped builders restricted to specific applications. The public user create and update endpoints accept a builder.apps field that defines which applications a user can build. In vulnerable versions, the server does not verify whether the caller has authority over the applications listed in that field. An app-scoped builder can therefore modify their own or another user's builder.apps array to include arbitrary application identifiers within the tenant. On the next request cycle, the elevated builder permissions are honored, granting full builder access to the targeted applications.
Root Cause
The root cause is missing authorization enforcement [CWE-862] on the user management API. The endpoint validates that the requester is authenticated and holds some builder role, but it does not check that the requester is authorized to grant builder access to each application referenced in the builder.apps payload. Authorization decisions are made based on the presence of any builder role rather than on scope-appropriate permissions.
Attack Vector
The vulnerability is exploitable over the network by an authenticated app-scoped builder. The attacker crafts a request to the user update API and supplies a builder.apps array containing application IDs they do not own. The server accepts the change and persists the escalated role assignment. No user interaction from other users is required. The attack requires low privileges but yields high confidentiality and integrity impact on tenant applications.
No verified proof-of-concept code has been published. See the GitHub Security Advisory GHSA-468g-55qj-v8rr and the VulnCheck Advisory for Budibase for technical details.
Detection Methods for CVE-2026-82240
Indicators of Compromise
- Requests to the Budibase public user create or update API that include a builder.apps field referencing applications the caller does not own.
- Unexpected role changes in user records where app-scoped builders acquire additional application IDs.
- Access to application builder interfaces by users who were not previously assigned to those applications.
Detection Strategies
- Audit user records for builder.apps arrays that grew over time without a corresponding administrative change ticket.
- Correlate API access logs against known builder assignments to identify unauthorized modifications.
- Alert on any modification to the builder object performed by a non-global-admin account.
Monitoring Recommendations
- Enable verbose logging on Budibase user management endpoints and forward logs to a centralized SIEM.
- Monitor for HTTP requests with request bodies containing builder.apps targeting applications outside the caller's assigned scope.
- Track newly granted builder access events and require approval workflow validation for each event.
How to Mitigate CVE-2026-82240
Immediate Actions Required
- Upgrade Budibase to version 3.41.3 or later without delay.
- Review all user accounts and revoke unexpected entries in builder.apps assignments.
- Rotate credentials and API keys for any application where unauthorized builder access is suspected.
- Restrict network access to Budibase administrative endpoints to trusted sources during patching.
Patch Information
The fix is included in Budibase 3.41.3. The patch adds server-side validation that the requester holds authority over each application listed in the builder.apps field before persisting role changes. Refer to the GitHub Security Advisory GHSA-468g-55qj-v8rr for release details.
Workarounds
- If immediate patching is not possible, disable the public user create and update endpoints or place them behind an authenticating reverse proxy that strips builder.apps fields from request bodies.
- Limit builder role assignment to global administrators until the upgrade is completed.
- Isolate sensitive applications into separate tenants to reduce blast radius from a single compromised builder account.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
