CVE-2026-45716: Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration

Synopsis

This is a privilege escalation vulnerability in Budibase, an open-source low-code platform. A user with builder-level permissions can send a crafted POST request to the /api/global/users/onboard endpoint, which skips the admin-restricted invite flow when SMTP email is not configured (the default for self-hosted instances), and directly creates a new global admin account, receiving the plaintext password in the response. Successful exploitation gives the attacker full administrative control over the Budibase instance. A patched-image rebuild at version 3.38.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Budibase API over the network to send a POST request to the onboard endpoint.

• AuthenticationRequired

  Any account with builder-level permissions is sufficient; no admin account is needed.

• Victim interactionNot required

  No action from another user or administrator is needed to complete the attack.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions or special environmental factors beyond the absence of SMTP configuration, which is the default state for self-hosted instances.

Blast Radius

• The attacker creates a new global admin account with a known password, gaining full administrative control over the Budibase instance.
• With admin access, the attacker reads all application data, user records, and credentials stored within the platform.
• The attacker modifies or deletes any application, datasource connection, or user account across the entire Budibase deployment.
• The attacker can disrupt all hosted applications and automations by altering or removing configurations at the global admin level.