Most recent entries from all

EUVD-2026-322247

fkie_cve-2026-45716

Budibase is an open-source low-code platform. Prior to 3.38.1, the POST /api/global/users/onboard endpoint is protected by workspaceBuilderOrAdmin middleware, allowing any user with builder permissions to access it. When SMTP email is not configured (the default for self-hosted Budibase instances), this endpoint bypasses the admin-restricted invite flow and directly creates users via bulkCreate, accepting arbitrary admin and builder role assignments from the request body. A builder-level user can create a new global admin account and receive the generated password in the response, achieving full privilege escalation. This vulnerability is fixed in 3.38.1.

GHSA-c54j-xp92-wh28 — Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration

Affected: npm: @budibase/worker

## Summary

The `POST /api/global/users/onboard` endpoint is protected by `workspaceBuilderOrAdmin` middleware, allowing any user with builder permissions to access it. When SMTP email is not configured (the default for self-hosted Budibase instances), this endpoint bypasses the admin-restricted invite flow and directly creates users via `bulkCreate`, accepting arbitrary `admin` and `builder` role assignments from the request body. A builder-level user can create a new global admin account and receive the generated password in the response, achieving full privilege escalation.

## Details

The vulnerability stems from a mismatch between the authorization level of the `onboardUsers` endpoint and the user-creation capabilities it exposes when SMTP is not configured.

**Route definition** (`packages/worker/src/api/routes/global/users.ts:93-109`): ```typescript builderOrAdminRoutes // <-- allows builders, not just admins .post( "/api/global/users/onboard", buildInviteMultipleValidation(), controller.onboardUsers ) ```

Compare with the `invite` and `inviteMultiple` endpoints which are correctly admin-only: ```typescript adminRoutes // <-- admin only .post("/api/global/users/invite", buildInviteValidation(), controller.invite) .post("/api/global/users/multi/invite", buildInviteMultipleValidation(), controller.inviteMultiple) ```

**Controller** (`packages/worker/src/api/controllers/global/users.ts:601-630`): ```typescript export const onboardUsers = async (c…

WID-SEC-W-2026-1477 — Budibase: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Code auszuführen oder seine Rechte zu erweitern.