Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration
Date: 2026-05
Affected: npm/@budibase/worker
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-45715
CVE-2026-45716
CWE: CWE-269
CWE-918
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

## Summary The `POST /api/global/users/onboard` endpoint is protected by `workspaceBuilderOrAdmin` middleware, allowing any user with builder permissions to access it. When SMTP email is not configured (the default for self-hosted Budibase instances), this endpoint bypasses the admin-restricted invite flow and directly creates users via `bulkCreate`, accepting arbitrary `admin` and `builder` role assignments from the request body. A builder-level user can create a new global admin account and receive the generated password in the response, achieving full privilege escalation. ## Details The vulnerability stems from a mismatch between the authorization level of the `onboardUsers` endpoint and the user-creation capabilities it exposes when SMTP is not configured. **Route definition** (`packages/worker/src/api/routes/global/users.ts:93-109`): ```typescript builderOrAdminRoutes // <-- allows builders, not just admins .post( "/api/global/users/onboard", buildInviteMultipleValidation(), controller.onboardUsers ) ``` Compare with the `invite` and `inviteMultiple` endpoints which are correctly admin-only: ```typescript adminRoutes // <-- admin only .post("/api/global/users/invite", buildInviteValidation(), controller.invite) .post("/api/global/users/multi/invite", buildInviteMultipleValidation(), controller.inviteMultiple) ``` **Controller** (`packages/worker/src/api/controllers/global/users.ts:601-630`): ```typescript export const onboardUsers = async (ct


Mitigations:

Architectural layers (MAESTRO):