CVE-2026-82240

CVE-2026-82240 is a missing-authorization flaw (CWE-862) in Budibase, an open-source low-code application platform, where the public user create and update endpoints fail to validate app-scoped builder role assignments. An authenticated app-scoped builder can exploit this by submitting crafted requests to the user update API that include arbitrary builder.apps fields. The attacker thereby grants themselves builder access to unrelated applications within the same tenant, gaining unauthorized ability to view and modify apps they should not control. Any deployment of Budibase before 3.41.3 is affected; exploitation requires an authenticated builder-level account, so multi-tenant deployments with multiple app-scoped builders face the greatest exposure. No public proof-of-concept or in-the-wild exploitation is known, and the EPSS score of 0.3% (17th percentile) suggests exploitation risk in the next 30 days is currently low.

What to do: Upgrade Budibase to version 3.41.3 or later, which validates app-scoped builder role assignments. Until patched, restrict the public user create/update endpoints to trusted administrators and review user role assignments for unexpected builder.apps grants. Multi-tenant operators should audit whether any app-scoped builders have gained builder access to apps outside their assigned scope.