GHSA-4qcj-m5wp-jmf4: Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
(updated )
The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user (including BASIC role) can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag.
References
- github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a
- github.com/Budibase/budibase/pull/19109
- github.com/Budibase/budibase/releases/tag/3.39.25
- github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4
- github.com/advisories/GHSA-4qcj-m5wp-jmf4
- nvd.nist.gov/vuln/detail/CVE-2026-73301
Code Behaviors & Features
Detect and mitigate GHSA-4qcj-m5wp-jmf4 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →