Description
Budibase is a low code platform for creating internal tools, workflows, and admin panels. This issue is a combination of Vertical Privilege Escalation and IDOR (Insecure Direct Object Reference) due to missing server-side RBAC checks in the /api/global/users endpoints. A Creator-level user, who should have no permissions to manage users or organizational roles, can instead promote an App Viewer to Tenant Admin, demote a Tenant Admin to App Viewer, or modify the Owner’s account details and all orders (e.g., change name). This is because the API accepts these actions without validating the requesting role, a Creator can replay Owner-only requests using their own session tokens. This leads to full tenant compromise.
INFO
Published Date :
2026-03-09T20:11:59.266Z
Last Modified :
2026-03-09T20:34:21.488Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-25045 vulnerability.
| Vendors | Products |
|---|---|
| Budibase |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-25045.
