CVE-2026-82245

CVE-2026-82245 is a missing authorization flaw (CWE-862) in Budibase's license management API. The /api/global/license/* endpoints do not verify a caller's role, so any authenticated user with basic privileges can call them over the network without user interaction. By deleting license keys or manipulating offline tokens, such a user can disable premium features and effectively downgrade the deployment for all users of that instance (rated High, CVSS 4.0 7.2). All Budibase deployments before version 3.41.3 are affected, whether self-hosted or cloud. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently puts 30-day exploitation probability at just 0.3% (20th percentile).

What to do: Upgrade to Budibase 3.41.3 or later. As an interim mitigation, restrict access to /api/global/license/* to administrator-level users (e.g., via a reverse proxy or network policy) and audit current license keys and offline tokens for tampering or deletion.