Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Budibase is a low code platform for creating internal tools, workflows, and admin panels. This issue is a combination of Vertical Privilege Escalation and IDOR (Insecure Direct Object Reference) due to missing server-side RBAC checks in the /api/global/users endpoints. A Creator-level user, who should have no permissions to manage users or organizational roles, can instead promote an App Viewer to Tenant Admin, demote a Tenant Admin to App Viewer, or modify the Owner’s account details and all orders (e.g., change name). This is because the API accepts these actions without validating the requesting role, a Creator can replay Owner-only requests using their own session tokens. This leads to full tenant compromise.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-25045 Vertical Privilege Escalation and IDOR in Budibase Platform User Management API https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25045
Post summary
The text announces CVE-2026-25045, noting vertical privilege escalation and IDOR vulnerabilities in the Budibase Platform User Management API, accompanied by a link to vulnerability details.
CVE-2026-25045 Budibase is a low code platform for creating internal tools, workflows, and admin panels. This issue is a combination of Vertical Privilege Escalation and IDOR (Insec… https://www.cve.org/CVERecord?id=CVE-2026-25045
Post summary
The post references CVE-2026-25045 in Budibase, indicating it involves vertical privilege escalation and IDOR, but it does not mention PoC, exploit code, active exploitation, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | budibase | budibase | - | - | - |