9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48150

CVE-2026-48150: Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign

Budibase is an open-source low-code platform. Prior to 3.39.0, /api/public/v1/roles/assign is guarded by the builderOrAdmin middleware, which passes any user who is a builder for the app id in the x-budibase-app-id header. That check admits both global builders and workspace-scoped builders (builder.apps set but builder.global unset). The controller then spreads the request body into the SDK call, and the SDK grants builder.global=true or admin.global=true on whichever user ids the caller supplies. Bob, a workspace-scoped builder with an API key, promotes himself or any other user to global admin with one POST. The whole flow is tenant-wide privilege escalation from an app-level role, available to anyone with an Enterprise license that unlocks the EXPANDED_PUBLIC_API feature. This vulnerability is fixed in 3.39.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48150

CVE-2026-48150:

9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@budibase/server	npm	< 3.39.0	3.39.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a privilege escalation in Budibase where a user with workspace-scoped builder permissions can escalate their privileges to global admin. This is caused by a combination of a weak authorization middleware and an unsafe SDK function.

The exploit flow starts with a request to the /api/public/v1/roles/assign endpoint.

The request is first processed by the builderOrAdmin middleware in packages/backend-core/src/middleware/builderOrAdmin.ts. This middleware is flawed because it allows users who are builders for a specific app (workspace-scoped) to pass, while the endpoint they are accessing can modify global roles. It should restrict access to global admins or global builders.
After the middleware, the request reaches the assign function in the controller at packages/server/src/api/controllers/public/roles.ts. Prior to the fix, this function took the request body, which can contain { "builder": true } or { "admin": true }, and passed these properties directly to the SDK function sdk.publicApi.roles.assign without any validation.
The assign function in the SDK at packages/pro/src/sdk/publicApi/roles.ts receives the user IDs and the properties to assign. It then unconditionally sets the global property to true for the builder or admin role (e.g., user.builder = { global: true }), effectively granting global privileges.

The patch was applied in the controller (packages/server/src/api/controllers/public/roles.ts) by adding a validation function validateGlobalRoleUpdate that is called within the assign and unAssign functions. This new function checks if the user making the request is a global admin or global builder before allowing the assignment of global roles, thus mitigating the vulnerability at the controller level. The unAssign function was also patched as it had a similar vulnerability.

The vulnerable functions that would appear in a runtime profile during exploitation are the middleware builderOrAdmin, the controller function assign, and the SDK function assign.

Vulnerable functions

assign

packages/server/src/api/controllers/public/roles.ts

This is the controller function for the `/api/public/v1/roles/assign` endpoint. Before the patch, it directly passed the request body to `sdk.publicApi.roles.assign` without validating if the user had the permissions to grant global roles. The patch added the `validateGlobalRoleUpdate` call to fix this.

unAssign

packages/server/src/api/controllers/public/roles.ts

Similar to the `assign` function, this controller function was vulnerable as it allowed a user with insufficient privileges to remove global roles from other users without proper authorization checks.

assign

packages/pro/src/sdk/publicApi/roles.ts

This SDK function performs the role update in the database. It is inherently unsafe as it unconditionally assigns global roles (`global: true`) based on its input, without verifying the caller's permissions. The fix was applied in the calling controller, but this function contains the unsafe logic.

builderOrAdmin

packages/backend-core/src/middleware/builderOrAdmin.ts

This middleware protects the role assignment endpoint. It is flawed because it incorrectly authorizes workspace-scoped builders, allowing them to access an endpoint that can grant global privileges. The check `isBuilder(ctx.user, workspaceId)` is not strict enough to differentiate between global and workspace-scoped builders.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.