PT-2026-5360 · Budibase · Budibase

Hasinohacker · Publicado 2026-01-29 · Atualizado 2026-03-03 · CVE-2026-25040

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.26.4

Description Budibase is a low code platform used for building internal tools, workflows, and admin panels. A Creator-level user, normally lacking UI permissions to invite users, can manipulate API requests to invite new users with any role – including Admin, Creator, or App Viewer – and assign them to any group within the organization. This enables full privilege escalation, bypassing UI restrictions, potentially leading to complete workspace or organization takeover. The API endpoint used for user invitation is susceptible to manipulation. The vulnerable request allows bypassing intended access controls.

Recommendations Update Budibase to version 3.26.4 or later.

Exploit

Correção

LPE

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-25040

GHSA-4WFW-R86X-QXRM

Produtos afetados

Budibase

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25040.json · Exploit
• 🔥 https://drive.google.com/file/d/1Dtn1WLJILRYUeoMjEbUfCbqQ3g2AW2Qz/view?usp=sharing · Exploit
• 🔥❌ https://github.com/user-attachments/files/22066135/budibase-privileged-esc-poc.txt · Exploit, Deleted
• https://github.com/Budibase/budibase/security/advisories/GHSA-4wfw-r86x-qxrm · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2016992607214456873 · Publicação no Twitter
• https://t.me/cveNotify/153944 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2017078171967893885 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-25040 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25040 · Nota de Segurança