Moratoantoine

**Name of the Vulnerable Software and Affected Versions** Budibase versions prior to 3.45.0 **Description** Insufficient per-app authorization validation in the 'POST /api/global/groups/:groupId/apps' endpoint allows users with builder privileges to assign application roles across workspace boundaries. An attacker with builder access to a single workspace can modify user group role mappings to grant themselves administrative roles in other workspaces. **Recommendations** Update to version 3.45.0 or later.