s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

CVE-2026-46424

📛 CVE Title

(no title)

Description

Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour

Overview

State
—
Assigner (CNA)
—
CVSS severity
medium
CVSS score
CVSS 4.2 / 10 4.2 4.2 / 10
CVSS vector
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Effective score
4.2 / 10 MEDIUM source: CNA overview
CWE(s)
—
Reserved
—
Published
—
Last updated
—
Source
https://www.tenable.com/cve/CVE-2026-46424

NVD / KEV / EPSS data refreshed 2026-05-25 00:14 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID
EUVD-2026-32597
Assigner
GitHub_M
Published
May 27, 2026, 5:05:21 PM
Updated
May 28, 2026, 2:08:42 PM
EUVD base score (CVSS 3.1)
4.2 / 10
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
EUVD-reported EPSS
0.1600
Vendors
budibase
Products
budibase (< 3.38.2)
Aliases
GHSA-6vp2-6r7m-2jvx

ENISA description: Budibase is an open-source low-code platform. Prior to 3.38.2, the public API role unassignment endpoint (POST /api/public/v1/roles/unassign) updates user documents in CouchDB but does not invalidate the corresponding Redis user cache entries. Because the authentication middleware resolves user identity and permissions from this cache (TTL: 3600 seconds), a user whose admin, builder, or app-level roles have been revoked via the public API retains those privileges for up to 1 hour. This vulnerability is fixed in 3.38.2.

EUVD references (2)

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (5)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

Remediations (10)

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-46424.json.

Not stored.