CVE-2026-73305

CVE-2026-73305 affects Budibase prior to 3.39.24. The public role-assign API /api/public/v1/roles/assign validates only global flags (admin/builder) and neglects per-app authorization (appBuilder.appId, role.appId). An app-scoped builder could scope actions to an app they control and grant themse...