Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or mani…

CVE-2026-82245 affects Budibase versions prior to 3.41.3, where role-based authorization is not enforced on license management API endpoints. Any authenticated user, regardless of privilege level, can access /api/global/license/* endpoints. This allows attackers with basic user accounts to delete license keys or manipulate offline tokens. The practical impact includes disabling premium features and downgrading deployments for all users of the affected instance. The vulnerability is classified as a missing authorization (broken access control) issue. It has been patched in Budibase version 3.41.3. The issue is documented in both the NVD and GitHub Security Advisories, as well as VulnCheck. Organizations running self-hosted or cloud Budibase instances below 3.41.3 should upgrade immediately. The vulnerability could be leveraged for denial-of-service against premium functionality or sabotage of enterprise deployments.