PT-2026-5360 · Budibase · Budibase

Hasinohacker · Published 2026-01-29 · Updated 2026-03-03 · CVE-2026-25040

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.26.4

Description Budibase is a low code platform used for building internal tools, workflows, and admin panels. A Creator-level user, normally lacking UI permissions to invite users, can manipulate API requests to invite new users with any role – including Admin, Creator, or App Viewer – and assign them to any group within the organization. This enables full privilege escalation, bypassing UI restrictions, potentially leading to complete workspace or organization takeover. The API endpoint used for user invitation is susceptible to manipulation. The vulnerable request allows bypassing intended access controls.

Recommendations Update Budibase to version 3.26.4 or later.

Exploit

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-25040

GHSA-4WFW-R86X-QXRM

Affected Products

Budibase

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25040.json · Exploit
• 🔥 https://drive.google.com/file/d/1Dtn1WLJILRYUeoMjEbUfCbqQ3g2AW2Qz/view?usp=sharing · Exploit
• 🔥❌ https://github.com/user-attachments/files/22066135/budibase-privileged-esc-poc.txt · Exploit, Deleted
• https://github.com/Budibase/budibase/security/advisories/GHSA-4wfw-r86x-qxrm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25040 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25040 · Security Note
• https://twitter.com/CVEnew/status/2016992607214456873 · Twitter Post
• https://t.me/cveNotify/153944 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2017078171967893885 · Twitter Post