CVE-2026-25045 Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role)

High 8.7 Published 9 Mar 2026 Updated 9 Mar 2026

Attackers with Creator roles can escalate privileges to Tenant Admin or modify Owner accounts due to missing server-side RBAC checks in user management APIs.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-25045?

CVE-2026-25045 is a high-severity missing authorization vulnerability in budibase, published on 9 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Budibase is a low code platform for creating internal tools, workflows, and admin panels. This issue is a combination of Vertical Privilege Escalation and IDOR (Insecure Direct Object Reference) due to missing server-side RBAC checks in the /api/global/users endpoints. A Creator-level user, who should have no permissions to manage users or organizational roles, can instead promote an App Viewer to Tenant Admin, demote a Tenant Admin to App Viewer, or modify the Owner’s account details and all orders (e.g., change name). This is because the API accepts these actions without validating the requesting role, a Creator can replay Owner-only requests using their own session tokens. This leads to full tenant compromise.

Weakness: CWE-862

Which versions are affected by CVE-2026-25045?

It affects 1 product.

Products include Budibase Budibase.

How do I fix CVE-2026-25045?

No fix has been published for CVE-2026-25045 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-25045 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25045 exists.

Sources

Also known as GHSA-2g39-332f-68p9.