GHSA-c54j-xp92-wh28
High · 8.8CVSS
8.8
EPSS
—
Published
May 18, 2026
CISA due date
—
The record
Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @budibase/worker | 0 | 3.38.1 |
Related vulnerabilities
- CVE-2026-45716 Budibase is an open-source low-code platform. Same vulnerability
- CVE-2026-114658 Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability… CWE-269
- CVE-2026-53614 util-linux is a random collection of Linux utilities. CWE-269
- CVE-2026-95837 containerd is an open-source container runtime. CWE-269
- CVE-2026-63349 AnyIO is a high level asynchronous concurrency and networking framework that works on top… CWE-269
- CVE-2026-92957 vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating… CWE-269
- CVE-2026-92958 vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. CWE-269
- CVE-2026-74925 The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role… CWE-269