CVE-2026-82240CWE-862broken-access-control

CVE-2026-82240

High · published August 28, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
29.0
In the wild
Unconfirmed
What it is

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps fields to escalate privileges and gain unauthorized builder access to other applications in the same tenant.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00363 · 29.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-28T16:16Z
References (2)
https://github.com/Budibase/budibase/security/advisories/GHSA-468g-55qj-v8rr · [email protected]https://www.vulncheck.com/advisories/budibase-before-3.41.3-privilege-escalation-via-user-update-api · [email protected]
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 10:49Z
    Budibase before 3.41.3 Privilege Escalation via User Update API
    cvelistv5