CVE-2026-73301

4.3 Moyenne

Publiée le 12/08/2026 à 21:17 · Modifiée le 08/09/2026 à 22:56 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder permissions, and default-group flags. The disclosure exposes the tenant access-control structure to users who are not builders or administrators. This issue is fixed in version 3.39.25.

Traduire en français

Produits concernés

budibase

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-862

Références

https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a
https://github.com/Budibase/budibase/pull/19109
https://github.com/Budibase/budibase/releases/tag/3.39.25
https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4
https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories