Budibase is an open-source low-code platform. Prior to 3.38.2, the public API role unassignment endpoint (POST /api/public/v1/roles/unassign) updates user documents in CouchDB but does not invalidate the corresponding Redis user cache entries. Because the authentication middleware resolves user identity and permissions from this cache (TTL: 3600 seconds), a user whose admin, builder, or app-level roles have been revoked via the public API retains those privileges for up to 1 hour. This vulnerability is fixed in 3.38.2.

Affected: npm: @budibase/backend-core

## Summary

The public API role unassignment endpoint (`POST /api/public/v1/roles/unassign`) updates user documents in CouchDB but does not invalidate the corresponding Redis user cache entries. Because the authentication middleware resolves user identity and permissions from this cache (TTL: 3600 seconds), a user whose admin, builder, or app-level roles have been revoked via the public API retains those privileges for up to 1 hour.

## Details

The root cause is an inconsistency between the `UserDB.save()` and `UserDB.bulkUpdate()` code paths.

**Vulnerable path** — `packages/pro/src/sdk/publicApi/roles.ts:49-75`: ```typescript export async function unAssign(userIds: string[], opts: AssignmentOpts) { // ... modifies user objects: deletes roles, admin, builder ... await userDB.bulkUpdate(users) // line 74 } ```

`bulkUpdate` delegates to `bulkUpdateGlobalUsers()` at `packages/backend-core/src/users/users.ts:82-85`: ```typescript export async function bulkUpdateGlobalUsers(users: User[]) { const db = getGlobalDB() return (await db.bulkDocs(users)) as BulkDocsResponse } ```

This writes directly to CouchDB with **no cache invalidation**.

**Correct path** — `packages/backend-core/src/users/db.ts:355` (used by admin UI): ```typescript await cache.user.invalidateUser(response.id) ```

**Cache configuration** — `packages/backend-core/src/cache/user.ts:11`: ```typescript const EXPIRY_SECONDS = 3600 // 1 hour TTL ```

**Authentication middleware** — `packages/backend-core…

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um Administratorrechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen oder vertrauliche Informationen offenzulegen.