Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps fields to escalate privileges and gain unauthorized builder access to other applications in the same tenant.

Budibase versions before 3.41.3 contain a privilege escalation vulnerability in the public user create and update endpoints. The flaw stems from a failure to validate app-scoped builder role assignments, allowing an authenticated app-scoped builder to grant themselves or others builder access to unrelated applications within the same tenant. Attackers can exploit this by submitting crafted requests to the user update API using the builder.apps field. This enables unauthorized builder access to other applications, effectively bypassing intended access controls. The vulnerability is classified as high severity given the potential for lateral privilege escalation across applications in a multi-tenant environment. A fix has been released in Budibase version 3.41.3. Security advisories have been published by both GitHub and VulnCheck.