A critical authorization flaw in Budibase server allows any authenticated user to disrupt premium features and manipulate license keys, posing a significant risk to service availability.

This is a missing authorization vulnerability (CWE-862) occurring within the /api/global/license/* endpoints. The flaw allows any user with basic authenticated access to perform administrative actions on license management, bypassing intended role-based access controls.

A successful exploit allows unauthorized users to disable premium features and downgrade deployments across the entire platform. Given the CVSS score of 8.1, this high-severity vulnerability could lead to significant operational disruption, loss of service functionality, and potential reputational damage if attackers choose to sabotage production environments.

Immediate Action: Upgrade the Budibase server instance to version 3.41.3 or later to ensure proper authorization enforcement on license endpoints.

Proactive Monitoring: Review application access logs for any unauthorized requests targeting the /api/global/license/ endpoint, particularly those originating from accounts without administrative privileges.

Compensating Controls: Implement strict network-level access controls to restrict access to the management API to known, trusted administrative IP addresses until the patch is applied.

Public Exploit Available: Unknown

The vulnerability presents a clear risk to the integrity and availability of your Budibase deployment. Because the attack vector is simple and does not require elevated privileges, administrators should prioritize updating to version 3.41.3 immediately to secure the license management interface against unauthorized manipulation.