High severity8.1NVD Advisory· Published Sep 26, 2026· Updated Oct 8, 2026
CVE-2026-100686
CVE-2026-100686
Description
Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant themselves admin roles in other workspaces by modifying user group role mappings.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
1- Budibase: Nine Vulnerabilities Including Auth Bypass and File Write Disclosed TogetherVypr Intelligence · Sep 26, 2026