CVE-2026-82240: Missing Authorization in budibase server
Description
Budibase server versions before 3.41.3 contain a missing authorization vulnerability in the public user create and update endpoints. This flaw allows authenticated app-scoped builders to escalate privileges by granting themselves builder access to unrelated applications within the same tenant. The vulnerability arises from improper validation of app-scoped builder role assignments, enabling unauthorized privilege escalation.
CVSS v4.0
Score 8.6high
Affected software
budibase
server
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-82240 is a missing authorization vulnerability in Budibase server versions prior to 3.41.3. The server fails to properly validate app-scoped builder role assignments in the public user create and update endpoints. As a result, an authenticated app-scoped builder can submit crafted requests to the user update API with manipulated builder.apps fields to escalate privileges and gain unauthorized builder access to other applications within the same tenant. This vulnerability has a CVSS 4.0 base score of 8.6, indicating high severity.
Potential Impact
An attacker with authenticated app-scoped builder privileges can escalate their access to other applications in the same tenant without authorization. This unauthorized access could lead to unauthorized modifications or control over unrelated applications, potentially compromising tenant data and operations.
Mitigation Recommendations
A fix is available in Budibase server version 3.41.3. Users should upgrade to version 3.41.3 or later to remediate this vulnerability. No additional vendor advisory content is provided, so patch status is based on the stated affected versions and version fixed.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-28T10:37:04.621Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a916f91acd9273b49cf92b4
Added to database: 08/28/2026, 11:22:57 UTC
Last enriched: 10/09/2026, 21:22:52 UTC
Last updated: 10/13/2026, 06:48:20 UTC
Views: 43
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.