CVE-2026-73305 Budibase CVE debrief

Who should care

Defenders responsible for Budibase installations, especially those with app-scoped builders, should assess their exposure and verify their installations are updated to version 3.39.24 or later.

Why it matters

Defenders should care about CVE-2026-73305 because it allows app-scoped builders to potentially grant themselves elevated privileges or arbitrary roles in other apps, exposing sensitive information and increasing the risk of unauthorized access. Budibase installations prior to version 3.39.24 are affected, and defenders should verify their installations and restrict builder privileges as necessary.

• Potential exposure of app data, datasource configuration, and automations
• Possible elevation of privileges for app-scoped builders
• Risk of unauthorized access to sensitive information
• Need for verification of Budibase installations and builder privileges

Technical summary

The vulnerability in Budibase prior to version 3.39.24 allowed an app-scoped builder to potentially grant themselves builder access or an arbitrary role in another app, exposing that app's data, datasource configuration, and automations. This was due to the validateGlobalRoleUpdate function being called without checking appBuilder.appId or role.appId. The issue was addressed by adding proper validation for appBuilder.appId and role.appId in the validateGlobalRoleUpdate function. Defenders should prioritize verifying their Budibase installations and ensuring they are updated to version 3.39.24 or later, especially if they have app-scoped builders with elevated privileges.

Defensive priority

Defenders should prioritize verifying their Budibase installations and ensuring they are updated to version 3.39.24 or later, especially if they have app-scoped builders with elevated privileges.

Recommended defensive actions

• Verify Budibase installations and update to version 3.39.24 or later
• Review app-scoped builder privileges and restrict access as necessary
• Monitor for suspicious activity related to role assignments and app data access
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to patches and advisories. The Budibase team has provided a patch for the vulnerability in version 3.39.24. Defenders should verify their installations and review app-scoped builder privileges to restrict access as necessary. The vulnerability was publicly disclosed on 2026-08-13 and has been modified on 2026-09-08. There are no known instances of exploitation. However, defenders should still verify their Budibase 3

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.