PT-2026-42049 · Budibase · Budibase

Offset · Published 2026-05-19 · Updated 2026-05-27 · CVE-2026-46424

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.38.2

Description The public API role unassignment endpoint "/api/public/v1/roles/unassign" updates user documents in CouchDB but fails to invalidate the corresponding Redis user cache entries. Because the authentication middleware resolves user identity and permissions from this cache, which has a Time To Live (TTL) of 3600 seconds, users whose admin, builder, or app-level roles are revoked via the public API retain those privileges for up to one hour. This occurs due to an inconsistency where the bulkUpdate() function writes directly to the database without triggering the necessary cache invalidation, unlike the path used by the admin UI.

Recommendations Update to version 3.38.2. As a temporary workaround, restrict access to the "/api/public/v1/roles/unassign" endpoint until the update is applied.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-46424

GHSA-6VP2-6R7M-2JVX

Affected Products

Budibase

References · 7

• 🔥 https://github.com/Budibase/budibase/security/advisories/GHSA-6vp2-6r7m-2jvx · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-46424 · Security Note
• https://osv.dev/vulnerability/GHSA-6vp2-6r7m-2jvx · Vendor Advisory
• https://github.com/Budibase/budibase · Note
• https://github.com/Budibase/budibase/releases/tag/3.38.2 · Note
• https://twitter.com/CVEnew/status/2059718135528526078 · Twitter Post
• https://twitter.com/infoflowcloud/status/2059719025668637167 · Twitter Post