CVE-2026-100686 Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps
Attackers can escalate privileges to admin in other workspaces by exploiting missing authorization checks in the group assignment API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100686?
CVE-2026-100686 is a high-severity vulnerability in budibase server, published on 26 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant themselves admin roles in other workspaces by modifying user group role mappings.
Weakness: CWE-269
Which versions are affected by CVE-2026-100686?
How do I fix CVE-2026-100686?
No fix has been published for CVE-2026-100686 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-100686 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100686 exists.
Sources
Also known as GHSA-9mjc-4gf6-xhx7, GHSA-pp5r-q4fp-mcj3.