Auth bypass in Budibase
CVE-2026-25040
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions up to and including 3.26.3, a Creator-level user, who normally has no UI permission to invite users, can manipulate API requests to invite new users with any role, including Admin, Creator, or App Viewer, and assign them to any group in the organization. This allows full privilege escalation, bypassing UI restrictions, and can lead to complete takeover of the workspace or organization. As of time of publication, no known fixed versions are available.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.006 (45.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 45.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.006 · change: +0.000
Affected products
- Budibase — versions <= 3.26.3
Weakness classification (CWE)
References
- github.com/Budibase/budibase/security/advisories/GHSA-4wfw-r86x-qxrm (Exploit, Vendor Advisory)
- drive.google.com/file/d/1Dtn1WLJILRYUeoMjEbUfCbqQ3g2AW2Qz/view (Exploit)
- github.com/user-attachments/files/22066135/budibase-privileged-esc-poc.txt (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2026-25040?
- CVE-2026-25040 is a high-severity vulnerability in Budibase, classified under Incorrect Authorization. CVSS score: 8.8/10. Published 2026-01-29.
- How severe is CVE-2026-25040?
- High severity. CVSS v3 base score is 8.8 out of 10.