Vulnerability Description
Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant themselves admin roles in other workspaces by modifying user group role mappings.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Budibase/budibase/security/advisories/GHSA-pp5r-q4fp-mcj3
- https://www.vulncheck.com/advisories/budibase-before-3.45.0-cross-workspace-priv
- https://github.com/Budibase/budibase/security/advisories/GHSA-pp5r-q4fp-mcj3
FAQ
What is CVE-2026-100686?
CVE-2026-100686 is a vulnerability with a CVSS score of 8.1 (HIGH). Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries....
How severe is CVE-2026-100686?
CVE-2026-100686 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-100686?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.