Threats tagged 'ghsa-9mjc-4gf6-xhx7'

Budibase server versions before 3.45.0 contain an improper privilege management vulnerability in the POST /api/global/groups/:groupId/apps endpoint. This flaw allows builders to bypass per-application authorization checks and assign themselves admin roles in other workspaces by modifying user group role mappings. The vulnerability enables privilege escalation across workspace boundaries.