CVE-2026-48150Disclosure

LOWCVSS 9.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Budibase is an open-source low-code platform. Prior to 3.39.0, /api/public/v1/roles/assign is guarded by the builderOrAdmin middleware, which passes any user who is a builder for the app id in the x-budibase-app-id header. That check admits both global builders and workspace-scoped builders (builder.apps set but builder.global unset). The controller then spreads the request body into the SDK call, and the SDK grants builder.global=true or admin.global=true on whichever user ids the caller supplies. Bob, a workspace-scoped builder with an API key, promotes himself or any other user to global admin with one POST. The whole flow is tenant-wide privilege escalation from an app-level role, available to anyone with an Enterprise license that unlocks the EXPANDED_PUBLIC_API feature. This vulnerability is fixed in 3.39.0.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-915

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-05-27); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-27	2	Disclosure2
2026-06-12	1	Disclosure1

Full discourse3 posts

Upwind Security MDR@UpwindMDR121d
Disclosure
🚨Critical - Budibase Workspace Builder to Global Admin Privilege Escalation (CVE-2026-48150) The /api/public/v1/roles/assign endpoint is guarded by middleware that admits workspace-scoped builders, not just global ones. The controller spreads the request body directly into the SDK, which sets http://builder.global=true or http://admin.global=true without ever checking whether the caller already holds that privilege. A workspace-scoped builder with an API key can scope a single POST to an app they control (via the x-budibase-app-id header) and promote themselves or any other user to global admin - full tenant takeover from an app-level role. The mass-assignment also strips existing scoping from the target's role. Requires an Enterprise license with EXPANDED_PUBLIC_API enabled. 👉Upgrade to Budibase 3.39.0.
Post summary
The post discloses a privilege‑escalation flaw in Budibase’s role‑assignment API that allows workspace‑scoped builders to become global admins, and recommends upgrading to v3.39.0 to patch the issue.
0000053
216 followersView on X
Infoflowcloud@infoflowcloud137d
Disclosure
🚨*CVE* CVE-2026-48150 Budibase is an open-source low-code platform. Prior to 3.39.0, /api/public/v1/roles/assign is guarded by the builderOrAdmin middleware, which passes any user who is a… https://www.cve.org/CVERecord?id=CVE-2026-48150 ----- Traducción: CVE-2026-48150 Bud… http://infoflow.cloud`
Post summary
The message announces CVE-2026-48150, detailing a flaw in Budibase's role assignment endpoint where the guard middleware is insufficiently restrictive.
0000034
79 followersView on X
CVE@CVEnew137d
Disclosure
CVE-2026-48150 Budibase is an open-source low-code platform. Prior to 3.39.0, /api/public/v1/roles/assign is guarded by the builderOrAdmin middleware, which passes any user who is a… https://www.cve.org/CVERecord?id=CVE-2026-48150
Post summary
The CVE affects Budibase’s role‐assignment API endpoint, where inadequate middleware authorization before version 3.39.0 could allow unauthorized privilege escalation.
00000180
57.5K followersView on X

Explore more

Back to dashboard