In Budibase versions up to and including 3.26.3, a Creator-level user can alter API requests to invite any new user with any organization role, including Admin, Creator, or App Viewer. This bypasses the UI restriction that normally denies creators the ability to invite users, enabling the attacker to grant themselves or another user full administrative control over the workspace or entire organization. The vulnerability represents a classic case of insufficient access control (CWE-863) and can lead to complete takeover of the system.

The affected product is Budibase, a low‑code platform for internal tools and admin panels. All installations running versions up to and including 3.26.3 are vulnerable; the issue is not limited to any specific deployment scenario.

The CVSS score of 5.7 indicates a moderate severity level, and the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, reducing its current threat visibility. Bypassing UI restrictions via crafted API calls is inferred as the attack vector; the attacker needs only network access to the API endpoint, making the attack possible over the internet or private networks.