CVE-2026-73301

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.25

Description An issue exists where the 'GET /api/global/groups' endpoint fails to verify if the user has builder or administrator privileges. This allows an authenticated user with a BASIC role to enumerate tenant groups, role mappings, user memberships, builder permissions, and default-group flags, thereby exposing the tenant access-control structure.

Recommendations Update to version 3.39.25.