CVE-2026-46425

@@ -1,4 +1,5 @@
 import Router from "@koa/router"
+import { auth } from "@budibase/backend-core"
 import { middleware as proMiddleware } from "@budibase/pro"
 import { Feature } from "@budibase/types"
 import * as userController from "../../controllers/global/scim/users"
@@ -10,6 +11,7 @@ const router: Router = new Router({
 
 router.use(proMiddleware.requireSCIM)
 router.use(proMiddleware.doInScimContext)
+router.use(auth.adminOnly)
 
 router.get("/users", userController.get)
 router.get("/users/:id", proMiddleware.scimUserOnly("id"), userController.find)

@@ -8,8 +8,14 @@ import {
   ScimUpdateRequest,
   ScimUserResponse,
 } from "@budibase/types"
+import {
+  context,
+  db as dbCore,
+  encryption,
+  events,
+  utils,
+} from "@budibase/backend-core"
 import { TestConfiguration } from "../../../../tests"
-import { events } from "@budibase/backend-core"
 
 jest.setTimeout(30000)
 
@@ -28,6 +34,33 @@ describe("scim", () => {
 
   const config = new TestConfiguration()
 
+  async function createAPIKeyForUser(userId: string) {
+    const apiKey = encryption.encrypt(
+      `${config.tenantId}${dbCore.SEPARATOR}${utils.newid()}`
+    )
+
+    await config.doInTenant(async () => {
+      const db = context.getGlobalDB()
+      await db.put({
+        _id: dbCore.generateDevInfoID(userId),
+        userId,
+        apiKey,
+      })
+    })
+
+    return apiKey
+  }
+
+  async function withAPIKey<T>(apiKey: string, fn: () => Promise<T>) {
+    const previousAPIKey = config.apiKey
+    config.apiKey = apiKey
+    try {
+      return await fn()
+    } finally {
+      config.apiKey = previousAPIKey
+    }
+  }
+
   const unauthorisedTests = (fn: (...params: any) => Promise<any>) => {
     describe("unauthorised calls", () => {
       it("unauthorised calls are not allowed", async () => {
@@ -82,6 +115,19 @@ describe("scim", () => {
   })
 
   describe("/api/global/scim/v2/users", () => {
+    describe("authorisation", () => {
+      it("returns 403 when a non-admin user API key calls SCIM", async () => {
+        const user = await config.createUser()
+        const apiKey = await createAPIKeyForUser(user._id!)
+
+        const response = await withAPIKey(apiKey, () =>
+          config.api.scimUsersAPI.get({ expect: 403 })
+        )
+
+        expect(response).toEqual(config.adminOnlyResponse())
+      })
+    })
+
     describe("GET /api/global/scim/v2/users", () => {
       const getScimUsers = config.api.scimUsersAPI.get
 

@@ -227,7 +227,9 @@ export class UserDB {
   }
 
   static async bulkUpdate(users: User[]) {
-    return await usersCore.bulkUpdateGlobalUsers(users)
+    const response = await usersCore.bulkUpdateGlobalUsers(users)
+    await Promise.all(users.map(user => cache.user.invalidateUser(user._id!)))
+    return response
   }
 
   static async save(user: User, opts: SaveUserOpts = {}): Promise<User> {

@@ -1,6 +1,7 @@
 import { BulkUserCreated, User, UserGroup, UserStatus } from "@budibase/types"
 import { DBTestConfiguration, generator, structures } from "../../../tests"
 import * as accounts from "../../accounts"
+import * as cache from "../../cache"
 import { getGlobalDB } from "../../context"
 import { withEnv } from "../../environment"
 import { UserDB } from "../db"
@@ -42,6 +43,33 @@ describe("UserDB", () => {
     groups.getDefaultGroup.mockResolvedValue(undefined)
   })
 
+  describe("bulkUpdate", () => {
+    it("invalidates cached user data for updated users", async () => {
+      await config.doInTenant(async () => {
+        const user = await db.save(
+          structures.users.user({
+            email: generator.email({}),
+            firstName: "Original",
+            tenantId: config.getTenantId(),
+          })
+        )
+
+        await cache.user.getUser({
+          userId: user._id!,
+          tenantId: config.getTenantId(),
+        })
+
+        await db.bulkUpdate([{ ...user, firstName: "Updated" }])
+
+        const refreshedUser = await cache.user.getUser({
+          userId: user._id!,
+          tenantId: config.getTenantId(),
+        })
+        expect(refreshedUser.firstName).toBe("Updated")
+      })
+    })
+  })
+
   describe("save", () => {
     describe("create", () => {
       it("creating a new user will persist it", async () => {