CVE-2026-46425: Budibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant users

Synopsis

This is an authorization bypass vulnerability in Budibase, an open-source low-code platform. Any authenticated user, including those with only a BASIC role, can reach the SCIM (System for Cross-domain Identity Management) API endpoints over the network without needing elevated privileges, because the SCIM router performs no role-based access check. Successful exploitation lets an attacker create, read, update, and delete every user and group across the entire tenant. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Budibase worker service over the network; any externally or internally exposed deployment is in scope.

• AuthenticationRequired

  A low-privilege account is sufficient: any valid Budibase session (BASIC role or workspace-scoped builder) satisfies the only credential check in place.

• Victim interactionNot required

  No victim action is needed; the attacker calls the SCIM endpoints directly without any social-engineering step.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or specific memory layout are required to reach the unprotected SCIM router.

Blast Radius

• Reads the full user and group directory for the tenant, exposing email addresses, role assignments, and account metadata for every user.
• Creates new user accounts with arbitrary roles, enabling persistent backdoor access to the Budibase tenant.
• Modifies existing user records and group memberships, allowing privilege escalation or lateral movement within the platform.
• Deletes users and groups across the entire tenant, causing irreversible disruption to access control and potentially locking out legitimate administrators.