Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions up to and including 3.26.3, a Creator-level user, who normally has no UI permission to invite users, can manipulate API requests to invite new users with any role, including Admin, Creator, or App Viewer, and assign them to any group in the organization. This allows full privilege escalation, bypassing UI restrictions, and can lead to complete takeover of the workspace or organization. As of time of publication, no known fixed versions are available.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-01-29 | 1 | General1 |
| 2026-01-30 | 1 | Disclosure1 |
CVE-2026-25040 Privilege Escalation Vulnerability in Budibase Low-Code Platform Through User Invitation API https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25040
Post summary
A new privilege escalation vulnerability (CVE-2026-25040) affecting Budibase's user invitation API has been disclosed, with technical details provided but no PoC, exploit, patch, or active exploitation information.
CVE-2026-25040 Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions up to and including 3.26.3, a Creator-level user, who normally h… https://www.cve.org/CVERecord?id=CVE-2026-25040
Post summary
The text references CVE‑2026‑25040 in Budibase but offers no further details on exploitation, remediation, or technical specifics, merely pointing to the CVE record.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | budibase | budibase | - | - | - |