CVE-2026-82245: Budibase Authorization Bypass Vulnerability

CVE-2026-82245 Overview

CVE-2026-82245 is a missing authorization vulnerability [CWE-862] in Budibase versions prior to 3.41.3. The low-code platform fails to enforce role-based access control on its license management endpoints exposed under /api/global/license/*. Any authenticated user, including accounts with only basic privileges, can invoke these endpoints to delete license keys or manipulate offline tokens. Successful exploitation disables premium features and downgrades deployments for every tenant on the affected instance. The flaw impacts integrity and availability of the platform's licensing subsystem while requiring no user interaction.

Critical Impact
Any authenticated Budibase user can delete license keys or tamper with offline tokens, downgrading the deployment and disabling premium functionality for all users on the instance.

Affected Products

Budibase versions before 3.41.3
Self-hosted Budibase deployments exposing /api/global/license/*
Multi-tenant Budibase instances with basic-privilege user accounts

Discovery Timeline

2026-08-28 - CVE-2026-82245 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82245

Vulnerability Analysis

Budibase exposes an administrative API surface under /api/global/license/* for managing product licensing, including license keys and offline activation tokens. These endpoints are intended for tenant administrators. In versions before 3.41.3, the platform's route middleware validates that the caller is authenticated but does not verify that the caller holds an administrator role. An attacker with any valid session, including a newly self-registered or invited basic user, can issue direct requests to these license routes and receive a successful response.

The practical impact is a broken access control condition affecting a shared configuration surface. Deleting a license key reverts the deployment to the free tier, disabling premium features across every workspace on the instance. Manipulating the offline token can invalidate license state or force reactivation flows. The vulnerability does not disclose data, but it degrades service integrity and availability for all tenants sharing the affected server.

Root Cause

The root cause is missing authorization enforcement on license management routes. Authentication middleware is present, but the required role check for administrative operations is absent. This maps directly to CWE-862: Missing Authorization.

Attack Vector

Exploitation requires network access to the Budibase API and a valid low-privilege account. The attacker sends authenticated HTTP requests to endpoints under /api/global/license/*, such as license deletion or offline token manipulation routes. No social engineering or client-side interaction is required. Full technical detail is available in the GitHub Security Advisory GHSA-4wr8-5c3p-rjcr and the VulnCheck Advisory for Budibase.

Detection Methods for CVE-2026-82245

Indicators of Compromise

Unexpected HTTP requests to /api/global/license/* originating from non-administrator user sessions.
Sudden loss of premium features, missing license key, or reactivation prompts appearing without administrator action.
Audit log entries showing license deletion or offline token changes attributed to basic-role accounts.

Detection Strategies

Enable request logging on the Budibase reverse proxy and alert on any DELETE or state-changing method targeting /api/global/license/*.
Correlate the acting user's role from session context with the sensitivity of the requested endpoint and flag mismatches.
Review authentication logs for recently created or invited low-privilege accounts that subsequently call license routes.

Monitoring Recommendations

Forward Budibase application and reverse-proxy logs to a centralized analytics pipeline for retention and correlation.
Baseline normal administrative activity so anomalous access to license endpoints stands out.
Alert on license-state changes reported by the Budibase admin UI and cross-check against change tickets.

How to Mitigate CVE-2026-82245

Immediate Actions Required

Upgrade Budibase to version 3.41.3 or later on all self-hosted deployments.
Audit user accounts and revoke unnecessary or dormant low-privilege accounts on affected instances.
Review license state and audit logs for unauthorized deletions or offline token modifications since the vulnerable version was deployed.

Patch Information

Budibase resolved the issue in version 3.41.3 by enforcing role-based authorization on license management endpoints. Details are documented in GitHub Security Advisory GHSA-4wr8-5c3p-rjcr.

Workarounds

Restrict access to /api/global/license/* at a reverse proxy or WAF layer, allowing only requests from trusted administrator networks until patching is complete.
Disable open user self-registration and tighten invitation workflows to limit the pool of authenticated attackers.
Rotate license keys and offline tokens after upgrading if unauthorized activity is suspected.

bash

# Example nginx snippet restricting license endpoints to an admin CIDR
location /api/global/license/ {
    allow 10.0.0.0/24;   # trusted admin network
    deny all;
    proxy_pass http://budibase_upstream;
}