CVE-2026-73305

COMPONENT VERSION RANGE

NewScan fingerprints Budibase from its response and reports this CVE when the detected version falls inside the affected range below.

MEASURED 2026-08-14 against vulhub/budibase 3.31.4 (training/cve budibase-idor). The version arrives from the tech_signatures "Budibase" version_from on /api/system/status, which answers anonymously with {"health":{"passing":true},"version":"3.31.4"}; without that row these are dead data, because nothing fingerprinted Budibase at all. validateGlobalRoleUpdate was called without checking appBuilder.appId or role.appId, so a builder scoped to one app could assign roles in another. Its own boundary (3.39.24). Version-match only. Every id here is either authenticated-builder-level or reachable only by mutating somebody's application data (SQL injection into their datasource, an arbitrary file write, a tenant-owner email change), so none can be confirmed in-band without doing the damage the finding warns about.