Keys to the Kingdom: Critical 9.9 CVSS Budibase Flaw Allows Total Tenant Takeover

Budibase disclosed a critical authorization-bypass vulnerability (CVE-2026-46425, CVSS ~9.9) in its SCIM endpoints where role-based checks were omitted; any authenticated user in tenants with SCIM enabled could list, create, modify, or delete users and groups, enabling PII exposure, account takeover, admin deletion, and role escalation. The issue affects versions prior to 3.38.2 and has been fixed in 3.38.2 — administrators are advised to update immediately.