While operating the Budibase low‑code platform, the /api/public/v1/roles/assign endpoint was protected only by a middleware that allowed any user with a builder role for a specified app ID to authenticate. The backend then forwarded the request body to an SDK call that could set a user’s builder.global or admin.global flag without further checks. Consequently, a workspace‑scoped builder who had an API key could elevate themselves or any other user to a global administrator with a single POST request, effectively granting overarching control across the tenant.

All Budibase installations running a version earlier than 3.39.0 that have the EXPANDED_PUBLIC_API feature enabled, typically requiring an Enterprise license, are affected. Any application deployed within such an instance and any user possessing a builder role for an app can exploit this flaw.

The CVSS score of 9 indicates a critical severity. Although the EPSS score is not available, the flaw is reachable remotely through the public API and provides direct full‑tenant control. The vulnerability is not listed in the CISA KEV catalog, but its potential for widespread impact and the lack of mitigation mechanisms make it highly dangerous. Anyone who can obtain or guess an API key for a workspace‑scoped builder can exploit this flaw.