CVE-2026-100686: Budibase Server

High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days.

Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant themselves admin roles in other workspaces by modifying user group role mappings.

Affected products

• Budibase Server: before 3.45.0 (fixed in 3.45.0)

Published 2026-09-26. Last modified 2026-10-08.