{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/budibase--3.39.19/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Budibase (\u003c= 3.39.19)","npm/@budibase/server (\u003c= 3.38.1)"],"_cs_severities":["high"],"_cs_tags":["budibase","privilege-escalation","API-abuse","authorization-bypass","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Budibase"],"content_html":"\u003cp\u003eBudibase versions up to 3.39.19 are vulnerable to a high-severity privilege escalation flaw (GHSA-j9fc-w3mr-x6mv) allowing an app-scoped builder to gain unauthorized builder access to any other application within the tenant. This vulnerability, an an incomplete fix of a previous hardening attempt, stems from a missing authorization check in the \u003ccode\u003ePOST /api/public/v1/roles/assign\u003c/code\u003e API endpoint. Attackers can leverage their existing app-scoped builder privileges to self-assign elevated roles or cross-app builder access, leading to a tenant-wide compromise of app data and the potential for remote code execution via automation steps, as well as exfiltration of stored datasource credentials. The flaw impacts licensed Budibase deployments (Business/Enterprise) where \u003ccode\u003eisExpandedPublicApiEnabled\u003c/code\u003e is active.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker, possessing an app-scoped builder role for \u003ccode\u003eappA\u003c/code\u003e but no global administrative privileges, initiates the attack.\u003c/li\u003e\n\u003cli\u003eThe attacker authenticates and sends a \u003ccode\u003ePOST\u003c/code\u003e request to the \u003ccode\u003e/api/global/self/api_key\u003c/code\u003e endpoint on the Budibase worker, successfully obtaining a public API key, as app-scoped builders have \u003ccode\u003ehasBuilderPermissions\u003c/code\u003e which passes the \u003ccode\u003ebuilderOnly\u003c/code\u003e middleware check.\u003c/li\u003e\n\u003cli\u003eUsing the newly acquired API key and their session cookie, the attacker sends a \u003ccode\u003ePOST\u003c/code\u003e request to \u003ccode\u003e/api/public/v1/roles/assign\u003c/code\u003e, setting the \u003ccode\u003ex-budibase-app-id\u003c/code\u003e header to \u003ccode\u003eappA\u003c/code\u003e (their controlled app ID) and including a JSON body specifying \u003ccode\u003e{\u0026quot;userIds\u0026quot;:[\u0026quot;\u0026lt;self\u0026gt;\u0026quot;],\u0026quot;appBuilder\u0026quot;:{\u0026quot;appId\u0026quot;:\u0026quot;\u0026lt;appB\u0026gt;\u0026quot;}}\u003c/code\u003e where \u003ccode\u003eappB\u003c/code\u003e is the target application.\u003c/li\u003e\n\u003cli\u003eThe API endpoint's \u003ccode\u003ebuilderOrAdmin\u003c/code\u003e middleware passes due to \u003ccode\u003eisBuilder(user, appA)\u003c/code\u003e, and the \u003ccode\u003evalidateGlobalRoleUpdate\u003c/code\u003e function (designed for global roles) ignores the \u003ccode\u003eappBuilder\u003c/code\u003e attribute, which was not referenced for validation.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003esdk.publicApi.roles.assign\u003c/code\u003e function processes the request, adding \u003ccode\u003eappB\u003c/code\u003e to the attacker's \u003ccode\u003euser.builder.apps\u003c/code\u003e without performing any authorization checks that the caller controls \u003ccode\u003eappB\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully escalates privileges, becoming a builder for \u003ccode\u003eappB\u003c/code\u003e and potentially any other app within the tenant.\u003c/li\u003e\n\u003cli\u003eWith builder access to \u003ccode\u003eappB\u003c/code\u003e, the attacker can now read/modify all data rows, access and exfiltrate stored datasource credentials, and modify automations to achieve remote code execution via \u003ccode\u003ebash\u003c/code\u003e, \u003ccode\u003eexecuteScript\u003c/code\u003e, or \u003ccode\u003eexecuteQuery\u003c/code\u003e steps, leading to tenant-wide app/data-plane compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful exploitation of this vulnerability allows an app-scoped builder to bypass cross-app isolation, gaining builder access to all other applications within the licensed Budibase tenant. This enables the attacker to read and modify sensitive data, exfiltrate stored datasource credentials (e.g., database connection strings, API keys), and create or modify automation rules to execute arbitrary code on the server. The attacker can also assign any data-plane role, including \u003ccode\u003eADMIN\u003c/code\u003e, to themselves or any other user within any application. While it doesn't directly grant global \u003ccode\u003eadmin\u003c/code\u003e or \u003ccode\u003ebuilder\u003c/code\u003e flags, it effectively leads to a tenant-wide compromise of all app data and functionality.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Budibase deployments to a patched version to remediate the missing authorization checks in the \u003ccode\u003ePOST /api/public/v1/roles/assign\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eImplement API gateway or WAF rules to inspect and validate requests to the \u003ccode\u003e/api/public/v1/roles/assign\u003c/code\u003e endpoint, specifically checking if the \u003ccode\u003eappId\u003c/code\u003e in the request body matches the \u003ccode\u003ex-budibase-app-id\u003c/code\u003e header for non-global administrators.\u003c/li\u003e\n\u003cli\u003eMonitor \u003ccode\u003ewebserver\u003c/code\u003e logs for unusual or excessive \u003ccode\u003ePOST\u003c/code\u003e requests to \u003ccode\u003e/api/global/self/api_key\u003c/code\u003e and \u003ccode\u003e/api/public/v1/roles/assign\u003c/code\u003e endpoints from non-global administrator accounts, which could indicate attempts to exploit this vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T21:15:22Z","date_published":"2026-07-24T21:15:22Z","id":"https://feed.craftedsignal.io/briefs/2026-07-budibase-privilege-escalation/","summary":"An app-scoped builder in Budibase can exploit a missing authorization flaw in the public role assignment API (`POST /api/public/v1/roles/assign`) to escalate privileges, granting themselves builder access to any other application within the tenant, read/modify data, exfiltrate datasource credentials, and execute arbitrary code via automation steps, compromising the entire tenant's app and data plane in Budibase versions up to and including 3.39.19 and npm/@budibase/server up to 3.38.1.","title":"Budibase Privilege Escalation via Role Assignment API","url":"https://feed.craftedsignal.io/briefs/2026-07-budibase-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Budibase (\u003c= 3.39.19)","version":"https://jsonfeed.org/version/1.1"}