Any authenticated user, including those with BASIC role or workspace-scoped builder, can call the SCIM endpoints and perform create, read, update, and delete operations on any user or group within the tenant. This lack of role-based authorization grants the attacker broad access to tenant user data and allows manipulation of accounts, compromising confidentiality, integrity, and potentially availability. The vulnerability is a classic authorization bypass, identified as CWE-862.

Budibase installations using any version of the platform before release 3.38.2 are impacted. The issue resides in the packages/worker/src/api/routes/global/scim.ts module, which only enforces the SCIM feature flag and request context but does not impose any role check. Therefore every authenticated user, regardless of role, can reach these endpoints and perform CRUD operations on tenant users and groups.

With a CVSS score of 9.9 the vulnerability is considered Critical. The EPSS score is not available, but the absence of an EPSS does not diminish the high severity rating. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a direct HTTP request to the SCIM API endpoints from any authenticated user, with no additional prerequisites beyond authentication. Once accessed, the attacker can manipulate tenant users and groups without restriction.