CVE-2026-46424
Medium · 4.2CVSS
4.2
EPSS
0.2%
Published
May 27, 2026
CISA due date
—
The record
Budibase is an open-source low-code platform. Prior to 3.38.2, the public API role unassignment endpoint (POST /api/public/v1/roles/unassign) updates user documents in CouchDB but does not invalidate the corresponding Redis user cache entries. Because the authentication middleware resolves user identity and permissions from this cache (TTL: 3600 seconds), a user whose admin, builder, or app-level roles have been revoked via the public API retains those privileges for up to 1 hour. This vulnerability is fixed in 3.38.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @budibase/backend-core | 0 | 3.38.2 |
Related vulnerabilities
- GHSA-6vp2-6r7m-2jvx Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users… Same vulnerability
- GHSA-wxq7-x3qp-vcr8 Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection… Also affects @budibase/backend-core
- CVE-2026-48147 Budibase is an open-source low-code platform. Also affects @budibase/backend-core
- CVE-2026-42239 Budibase is an open-source low-code platform. Also affects @budibase/backend-core
- CVE-2026-41428 Budibase is an open-source low-code platform. Also affects @budibase/backend-core
- GHSA-4f9j-vr4p-642r Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full… Also affects @budibase/backend-core
- GHSA-8783-3wgf-jggf Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher… Also affects @budibase/backend-core
- GHSA-7r9j-r86q-7g45 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist Also affects @budibase/backend-core