Budibase versions before 3.45.0 lack per‑app authorization checks on the POST /api/global/groups/:groupId/apps endpoint, allowing a builder with access to a single workspace to modify group role mappings for applications in other workspaces. This flaw permits the attacker to elevate privileges and obtain admin rights beyond the intended workspace scope, providing unrestricted access to all resources within those additional workspaces.

Budibase server, all releases prior to 3.45.0.

The vulnerability scores an 8.6 on the CVSS scale, indicating high severity. Although EPSS data is unavailable, the flaw is exploitable by any user who already has builder permissions in a workspace, a role that is typically broadly granted. Because the flaw escalates privileges silently through the global endpoint, exploitation is likely to be straightforward with little user interaction beyond the normal application workflow. The vulnerability is not listed in the CISA KEV catalog, but its high CVSS score and privilege escalation nature warrant prioritized remediation.