VulnSocial

CVE-2026-46424Disclosure

LOWCVSS 4.2 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Budibase is an open-source low-code platform. Prior to 3.38.2, the public API role unassignment endpoint (POST /api/public/v1/roles/unassign) updates user documents in CouchDB but does not invalidate the corresponding Redis user cache entries. Because the authentication middleware resolves user identity and permissions from this cache (TTL: 3600 seconds), a user whose admin, builder, or app-level roles have been revoked via the public API retains those privileges for up to 1 hour. This vulnerability is fixed in 3.38.2.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-269

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-05-27: 2Patch / Workaround · 2026-05-27: 2Technical Details · 2026-05-27: 205-27
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-46424 Budibase is an open-source low-code platform. Prior to 3.38.2, the public API role unassignment endpoint (POST /api/public/v1/roles/unassign) updates user documents i… https://www.cve.org/CVERecord?id=CVE-2026-46424 ----- Traducción: CVE-2026-46424 Bud… http://infoflow.cloud`

    Post summary

    CVE-2026-46424 affects Budibase’s public API role unassignment endpoint; the issue is fixed in version 3.38.2, as indicated by the text.

    0000030
    79 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-46424 Budibase is an open-source low-code platform. Prior to 3.38.2, the public API role unassignment endpoint (POST /api/public/v1/roles/unassign) updates user documents i… https://www.cve.org/CVERecord?id=CVE-2026-46424

    Post summary

    CVE‑2026‑46424 exposes a flaw in Budibase’s public API role‑unassignment endpoint that can incorrectly update user documents; the issue is resolved in version 3.38.2.

    00000156
    57.5K followersView on X

Explore more

Back to dashboard