---
id: CVE-2026-73305
title: Budibase is an open-source low-code platform
summary: >-
  Budibase is an open-source low-code platform. Prior to 3.39.24, POST
  /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking
  appBuilder.appId or role.appId in
  packages/server/src/api/controllers/public/globalRoleVali…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-269
  - CWE-862
  - CWE-863
published: '2026-08-13'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:56:50.520'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73305'
references:
  - url: >-
      https://github.com/Budibase/budibase/commit/453391d3245dd04cc386ccd6959d38ccf30db9a8
    label: security-advisories@github.com
  - url: 'https://github.com/Budibase/budibase/pull/19098'
    label: security-advisories@github.com
  - url: 'https://github.com/Budibase/budibase/releases/tag/3.39.24'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Budibase/budibase/security/advisories/GHSA-j9fc-w3mr-x6mv
    label: security-advisories@github.com
  - url: >-
      https://github.com/Budibase/budibase/security/advisories/GHSA-j9fc-w3mr-x6mv
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00523
epssPercentile: 0.41879
ingestedAt: '2026-09-08T21:11:12.277Z'
---

## Overview

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to an app they control and then grant themselves builder access or an arbitrary role in another app, exposing that app data, datasource configuration, and automations. This issue is fixed in version 3.39.24.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.