A Creator-level user can exploit missing server‑side role checks on the /api/global/users API to promote or demote users and alter owner account details, effectively gaining full tenant control. This flaw combines vertical privilege escalation with an insecure direct object reference, allowing a low‑privileged account to perform actions reserved for higher‑level roles without validation. The impact is a compromise of confidentiality, integrity, and availability for the entire tenant.

Budibase, a low‑code platform for internal tools, is the affected product. The vulnerability applies to all deployments of Budibase where the /api/global/users endpoints are accessible, regardless of specific version numbers as none were disclosed.

The flaw carries a CVSS score of 8.7, indicating high severity. The EPSS score is less than 1%, suggesting exploitation is unlikely at present, yet the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is internal user compromise: a legitimate Creator account can use normal session tokens to replay Owner‑only requests. Successful exploitation leads to full tenant compromise, making rapid remediation crucial.