The vulnerability allows an attacker who can make a request to the public role assignment endpoint to bypass application‑level authorization checks. An app‑scoped builder can craft a request that assigns themselves builder access or any arbitrary role in another application, exposing that app’s data, data‑source configuration, and automations. This is a privilege‑escalation flaw that enables unauthorized data access and configuration tampering within affected Budibase deployments.

Budibase, an open‑source low‑code platform, is affected in all releases prior to 3.39.24. The flaw resides in the POST /api/public/v1/roles/assign endpoint that calls validateGlobalRoleUpdate without checking the appBuilder.appId or role.appId. Any instance running an older version that exposes this API is vulnerable.

The CVSS score of 8.8 indicates high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely path requires access to the public role‑assignment endpoint, typically accessible to authenticated builders or any user with web access to the application. Once the endpoint is hit, the attacker can assign privileged roles without further checks, making exploitation straightforward if the endpoint is reachable.