Description
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions up to and including 3.26.3, a Creator-level user, who normally has no UI permission to invite users, can manipulate API requests to invite new users with any role, including Admin, Creator, or App Viewer, and assign them to any group in the organization. This allows full privilege escalation, bypassing UI restrictions, and can lead to complete takeover of the workspace or organization. As of time of publication, no known fixed versions are available.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
https://github.com/Budibase/budibase/security/advisories/GHSA-4wfw-r86x-qxrm
Various Sources x_refsource_misc
https://drive.google.com/file/d/1Dtn1WLJILRYUeoMjEbUfCbqQ3g2AW2Qz/view?usp=sharing
Various Sources x_refsource_misc
https://github.com/user-attachments/files/22066135/budibase-privileged-esc-poc.txt
Scores
CVSS v3
8.8
EPSS
0.0052
EPSS Percentile
40.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-863
Status
published
Products (1)
budibase/budibase
< 3.26.3
Published
Jan 29, 2026
Tracked Since
Feb 18, 2026