The vulnerability allows a user with builder permissions to exploit the POST /api/global/users/onboard endpoint when SMTP email is not configured. In this scenario the endpoint bypasses the normal admin‑restricted invite flow and creates users with roles directly taken from the request body. A builder can therefore create a new global admin account and receive the generated password in the response, achieving full administrative privileges.

All Budibase installations running a version prior to 3.38.1 with the default self‑hosted configuration that lacks SMTP configuration are affected. The issue is present in the Budibase platform product, specifically any deployment where the builder role is granted and SMTP is omitted.

The CVSS score of 8.8 indicates high severity. Although no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the attack surface is relatively narrow—only requiring a builder‑level session—and the exploitation path is straightforward through the API. The likely attack vector is an authenticated POST request to the onboardUsers endpoint from any builder‑level user. Given the ease of exploitation and the potential for full admin control, the risk remains high for affected environments.