01 Record

CVE-2026-73305

Budibase: Privilege escalation via public role assignment API missing app-level authorization

HighPUBLISHEDCNA: GitHub_M

Base score8.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

02 Description

Budibase: Privilege escalation via public role assignment API missing app-level authorization

Published: 2026-08-13 22:05Z20 HR AGO
Last updated: 2026-08-13 22:05Z20 HR AGO
Reserved: 2026-08-11
Assigning CNA: GitHub_M
Record state: PUBLISHED
Severity: High (CVSS 8.8)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-269 CWE-862 CWE-863
SSVC decision: No CISA-ADP assessment
Data version: 5.2
Document digest: f8436d1b4cc25c2289e1eb5ad74f17efdfed5cfd662342ad6acf4a1174b1c749

VendorProductVersionsPlatforms

Budibasebudibase< 3.39.24—