Budibase versions up to 3.38.1 suffer from a missing authorization check in the public role-assignment API endpoint POST /api/public/v1/roles/assign. The endpoint validates only global role flags ('admin' and 'builder') but does not verify whether the caller has permission to assign app-scoped roles such as 'appBuilder' or arbitrary data-plane roles within specific apps. An attacker with app-scoped builder privileges on one app can exploit this by calling the endpoint with their own app ID in the header and specifying other apps in the role assignment payload, thereby granting themselves elevated roles on any app in the tenant. This flaw arises from an incomplete fix that only hardened global role validation, leaving app-level role assignments unchecked. The vulnerability allows crossing the security boundary from limited app builder access to full builder or admin access on any app, enabling unauthorized data access, configuration changes, and automation edits.

An attacker with app-scoped builder privileges on a single app can escalate their privileges to become a builder or admin on any other app within the same tenant. This breaks the intended isolation between apps, allowing unauthorized read and modification of data, access to datasource configurations including credentials, and the ability to alter automations and execute arbitrary scripts. The compromise affects confidentiality, integrity, and availability of all apps in the tenant. The vulnerability requires only low attack complexity and no user interaction, making it a high-severity risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict app-scoped builder roles carefully and monitor for suspicious role-assignment API usage. Avoid exposing the public role-assignment API to untrusted users. Review and harden authorization logic to ensure app-level role assignments require verification that the caller controls the target app. Follow vendor updates for a security patch addressing this missing authorization check.