CVE-2026-48150 Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
Workspace-scoped builders can escalate to global admin privileges via the public API, requiring an Enterprise license with the expanded public API feature enabled.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48150?
CVE-2026-48150 is a critical vulnerability in budibase, published on 27 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Budibase is an open-source low-code platform. Prior to 3.39.0, /api/public/v1/roles/assign is guarded by the builderOrAdmin middleware, which passes any user who is a builder for the app id in the x-budibase-app-id header. That check admits both global builders and workspace-scoped builders (builder.apps set but builder.global unset). The controller then spreads the request body into the SDK call, and the SDK grants builder.global=true or admin.global=true on whichever user ids the caller supplies. Bob, a workspace-scoped builder with an API key, promotes himself or any other user to global admin with one POST. The whole flow is tenant-wide privilege escalation from an app-level role, available to anyone with an Enterprise license that unlocks the EXPANDED_PUBLIC_API feature. This vulnerability is fixed in 3.39.0.
Weakness: CWE-915
Which versions are affected by CVE-2026-48150?
2 open source packages ship an affected version, including @budibase/server.
| Package | Affected | Fixed in |
|---|---|---|
@budibase/server npm | All versions | 3.39.0 |
@budibase/server npm | All versions | 3.39.0 |
How do I fix CVE-2026-48150?
Upgrade @budibase/server to 3.39.0 or later.
Is CVE-2026-48150 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48150 exists.
Sources
Also known as GHSA-6xp4-cf37-ppjh.