PT-2026-44061 · Budibase · Budibase

Adrgs · Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-48150

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.0

Description An issue exists in the open-source low-code platform where the '/api/public/v1/roles/assign' endpoint is guarded by the builderOrAdmin middleware. This middleware allows any user who is a builder for the app ID specified in the x-budibase-app-id header to pass, including both global builders and workspace-scoped builders. The controller then spreads the request body into the SDK call, allowing the SDK to grant builder.global=true or admin.global=true to any user IDs provided by the caller. This enables a workspace-scoped builder with an API key to promote themselves or other users to global admin, resulting in tenant-wide privilege escalation from an app-level role. This is available to users with an Enterprise license that enables the EXPANDED PUBLIC API feature.

Recommendations Update to version 3.39.0.

Exploit

Fix

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2026-48150

Affected Products

Budibase

References · 5

• 🔥 https://github.com/Budibase/budibase/security/advisories/GHSA-6xp4-cf37-ppjh · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-48150 · Security Note
• https://twitter.com/infoflowcloud/status/2059719145927663650 · Twitter Post
• https://twitter.com/CVEnew/status/2059718142793044015 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1tphgix/critical_privilege_escalation_flaw_found_in · Reddit Post