A missing authorization vulnerability in Budibase server allows authenticated users to escalate privileges and gain unauthorized access to applications within the same tenant, posing a significant security risk.

This is a missing authorization flaw (CWE-862) occurring within the user create and update API endpoints. The vulnerability allows an authenticated attacker with app-scoped builder privileges to manipulate the builder.apps field, successfully granting themselves unauthorized builder access to applications for which they lack permission.

The ability for a malicious user to escalate privileges and gain unauthorized control over unrelated applications within a shared tenant environment represents a critical breach of access control. This could lead to unauthorized data exposure, malicious modification of business logic, or total compromise of application integrity, warranting the high CVSS score of 8.1.

Immediate Action: Upgrade Budibase server to version 3.41.3 or later, which includes the necessary authorization checks to prevent unauthorized role assignment.

Proactive Monitoring: Review application audit logs for suspicious activity involving the user update API, specifically looking for unexpected modifications to the builder.apps field or unauthorized role escalations.

Compensating Controls: Implement strict Network Access Control (NAC) and monitor for anomalous API traffic patterns that deviate from standard user management workflows.

Public Exploit Available: Unknown.

Given the potential for horizontal privilege escalation and unauthorized application access, organizations utilizing Budibase should prioritize this update. Administrators must verify that all instances are upgraded to version 3.41.3 immediately to close the identified authorization gap and prevent potential tenant-wide compromise.