PT-2026-42120 · Budibase · Budibase

Adrgs · Published 2026-05-20 · Updated 2026-05-27 · CVE-2026-46425

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.38.2

Description An authorization bypass exists in the SCIM router within packages/worker/src/api/routes/global/scim.ts. The router only utilizes the requireSCIM and doInScimContext middlewares, failing to implement a role check. Consequently, any authenticated user, including those with the BASIC role or workspace-scoped builders, can access SCIM endpoints to perform Create, Read, Update, and Delete (CRUD) operations on every user and group within the tenant, potentially allowing them to delete administrators or hijack accounts.

Recommendations Update to version 3.38.2.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-46425

Affected Products

Budibase

References · 5

• 🔥 https://github.com/Budibase/budibase/security/advisories/GHSA-q9rw-q89f-jx2f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-46425 · Security Note
• https://github.com/Budibase/budibase/releases/tag/3.38.2 · Note
• https://twitter.com/the_yellow_fall/status/2056939059893928021 · Twitter Post
• https://twitter.com/CVEnew/status/2059718134396063813 · Twitter Post