Budibase is an open-source low-code platform. Prior to 3.38.1, the POST /api/global/users/onboard endpoint is protected by workspaceBuilderOrAdmin middleware, a…

Budibase open-source low-code platform contains a privilege escalation vulnerability in versions prior to 3.38.1. The POST /api/global/users/onboard endpoint allows builder-level users to bypass admin-restricted invite flow when SMTP email is not configured (default for self-hosted instances). Attackers can create new global admin accounts with arbitrary role assignments and receive generated passwords in response, achieving full privilege escalation. The vulnerability is fixed in version 3.38.1.