CVE-2026-73305: 
JavaScript vulnerability analysis and mitigation

CVE-2026-73305 is a privilege escalation vulnerability in Budibase, an open-source low-code platform, caused by missing app-level authorization in the public role assignment API. An authenticated app-scoped builder can exploit the flaw to grant themselves or other users builder access or arbitrary roles in applications they do not control. All Budibase versions prior to 3.39.24 (npm package @budibase/server < 3.40.0) are affected; the issue was disclosed on August 13, 2026, and fixed in version 3.39.24 released July 1, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause is improper privilege management (CWE-269), missing authorization (CWE-862), and incorrect authorization (CWE-863) in packages/server/src/api/controllers/public/globalRoleValidation.ts. The validateGlobalRoleUpdate() function only checks the global admin and builder flags; it does not validate appBuilder.appId or role.appId, meaning per-app grant vectors pass through to the SDK entirely unchecked. An attacker sets the x-budibase-app-id header to an app they legitimately build (satisfying the builderOrAdmin middleware), then sends a POST /api/public/v1/roles/assign request with an appBuilder or role body referencing a target app they do not control — the SDK blindly appends the target app to user.builder.apps or sets an arbitrary role in user.roles. A prerequisite is that the attacker holds an app-scoped builder role on at least one app in a Business/Enterprise licensed tenant (required for isExpandedPublicApiEnabled()), and can self-issue a public API key via POST /api/global/self/api_key (GitHub Advisory, Fix Commit).

A successful exploit allows an app-scoped builder to escalate to builder of every other app in the tenant, effectively achieving a tenant-wide app and data-plane compromise. The attacker can read and modify all rows in those apps, exfiltrate stored datasource credentials and configurations, and edit automations including server-side execution steps (bash, executeScript, executeQuery). Additionally, the attacker can assign arbitrary data-plane roles (e.g., ADMIN) in any app to any user, enabling further lateral movement across the platform. While global admin/builder flags remain protected, the cross-app builder escalation represents a near-complete compromise of application isolation within the tenant (GitHub Advisory).

No public proof-of-concept exploit code has been released, and there is no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated app-scoped builder account on a Business/Enterprise licensed Budibase tenant, limiting the attack surface to insider threats or compromised low-privilege accounts. No threat actor attribution has been reported (Feedly, GitHub Advisory).

1. Obtain app-scoped builder access: The attacker must already hold a builder role scoped to at least one app (e.g., appA) in a Business/Enterprise Budibase tenant.
2. Self-issue a public API key: Send POST /api/global/self/api_key with a valid session cookie. The builderOnly middleware passes because hasBuilderPermissions() is true for app-scoped builders, returning a public API key.
3. Identify the target app ID: Enumerate or infer the production workspace ID of the target app (appB) the attacker does not control.
4. Craft the privilege escalation request: Send the following request, setting x-budibase-app-id to the attacker's own app (appA) to satisfy the builderOrAdmin middleware:

POST /api/public/v1/roles/assign
x-budibase-api-key: <attacker_api_key>
x-budibase-app-id: <appA_id>
Content-Type: application/json

{"userIds":["<attacker_user_id>"],"appBuilder":{"appId":"<appB_id>"}}

5. Achieve privilege escalation: The server returns HTTP 200 and the SDK appends appB to user.builder.apps. The attacker is now a builder of appB.
6. Optionally assign arbitrary roles: Repeat step 4 with a role body ({"userIds":["<target_user_id>"],"role":{"appId":"<appB_id>","roleId":"ADMIN"}}) to assign ADMIN or any other data-plane role to any user in any app.
7. Access target app resources: Use the newly granted builder access to read all app data, exfiltrate datasource credentials, and modify automations in appB (GitHub Advisory).

• Network: Unexpected POST /api/global/self/api_key requests from app-scoped builder accounts; POST /api/public/v1/roles/assign requests where the x-budibase-app-id header references one app but the request body references a different appId in appBuilder or role fields.
• Logs: Access logs showing HTTP 200 responses to POST /api/public/v1/roles/assign with body payloads containing appBuilder.appId or role.appId values that differ from the x-budibase-app-id header; repeated role assignment calls from the same user account targeting multiple apps.
• Application State: User accounts with builder.apps arrays containing apps they were not originally assigned to; unexpected ADMIN or elevated role entries in user.roles for apps the user should not access.
• Behavioral: App-scoped builder accounts accessing datasource configurations, automation definitions, or row data in apps outside their originally assigned scope (GitHub Advisory, Feedly).

Upgrade Budibase to version 3.39.24 or later (npm @budibase/server >= 3.40.0), which adds the validateAppRoleUpdate() function to check that the caller is an admin or builder of the target app before processing appBuilder or role assignment requests. No configuration-based workaround is available; the fix requires a code-level patch. As immediate remediation steps: audit POST /api/public/v1/roles/assign access logs for unauthorized cross-app role assignments, revoke any suspicious builder or elevated roles granted between the vulnerability introduction and patching, and enforce the principle of least privilege for builder accounts (GitHub Release, Fix Commit).

The vulnerability was reported by researcher dinhvaren and published as GitHub Security Advisory GHSA-j9fc-w3mr-x6mv. The Hacker Wire covered the flaw in an article titled "Budibase Global Role Logic Flaw CVE-2026-73305," and a brief mention appeared on Mastodon via @thehackerwire. Community reaction has been limited given the restricted attack surface (Business/Enterprise license required), but the cross-app isolation bypass nature of the flaw drew attention to the risks of incomplete authorization hardening in low-code platforms (GitHub Advisory, The Hacker Wire).