Budibase is an open-source low-code platform. Prior to 3.38.1, the POST /api/global/users/onboard endpoint is protected by workspaceBuilderOrAdmin middleware, a…

Budibase open-source low-code platform contains a privilege escalation vulnerability in versions prior to 3.38.1. The POST /api/global/users/onboard endpoint allows builder-level users to bypass admin-restricted invite flow when SMTP is not configured. Attackers can exploit this to create global admin accounts with arbitrary role assignments and receive generated passwords in responses. This affects self-hosted instances by default since SMTP is typically not configured. The vulnerability is fixed in version 3.38.1.