Critical severity · published May 27, 2026
CVE-2026-46425
Budibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant users
9.9
CVSS
0.3%
EPSS
No
On KEV
Description
Budibase is an open-source low-code platform. Prior to 3.38.2, packages/worker/src/api/routes/global/scim.ts attaches only two middlewares to the SCIM router: requireSCIM (checks the Enterprise feature flag and SCIM config) and doInScimContext (sets the SCIM request context). There is no role check. Any authenticated user who reaches the worker (BASIC role, workspace-scoped builder, anyone) can call SCIM endpoints and CRUD every user and group in the tenant. This vulnerability is fixed in 3.38.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BU
budibase · Budibase
< 3.38.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-46425
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-46425
github.com
https://github.com/Budibase/budibase/releases/tag/3.38.2
github.com
https://github.com/Budibase/budibase/security/advisories/GHSA-q9rw-q89f-jx2f
More from budibase
9.9
CVE-2026-31818
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
9.8
CVE-2026-54350
Budibase: Anonymous NoSQL operator injection via published-app query templates
9.6
CVE-2026-73300
Budibase: SQL Injection via `multipleStatements: true`
9.6
CVE-2026-54351
Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override
9.6
CVE-2026-54352
Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload