Budibase is an open-source low-code platform. Prior to 3.38.2, packages/worker/src/api/routes/global/scim.ts attaches only two middlewares to the SCIM router: r…

CVE-2026-46425 affects Budibase, an open-source low-code platform, prior to version 3.38.2. The vulnerability exists in the SCIM router implementation where insufficient middleware validation allows any authenticated user to access SCIM endpoints without proper role checks. This authorization bypass enables users with basic privileges to perform CRUD operations on all users and groups within a tenant. The issue stems from missing role validation in the packages/worker/src/api/routes/global/scim.ts file. The vulnerability has been patched in version 3.38.2.