Skip to content
Threat Feed

Product

@Budibase/Worker (< 3.38.1)

1 brief RSS
high advisory

Budibase Builder-to-Admin Privilege Escalation via Unsecured onboardUsers Endpoint

A privilege escalation vulnerability exists in Budibase's `onboardUsers` endpoint (CVE-2026-45716) allowing a builder-level user to create global admin accounts by bypassing the intended invite flow when SMTP is not configured, due to insufficient authorization checks and direct user creation with attacker-controlled roles.

@budibase/worker privilege-escalation web-application budibase
2r 1t