{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.38.1"}],"component":"@budibase/server","cve_ids":["CVE-2026-73305"],"ecosystem":"npm","epss":0.00523,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-j9fc-w3mr-x6mv","id":"tcs_01M5KFXHJ5E6YKTEY8Z7E7BE9A","modified_at":"2026-08-12T19:11:12.382278Z","published_at":"2026-07-24T21:12:40Z","references":["https://osv.dev/vulnerability/GHSA-j9fc-w3mr-x6mv","https://github.com/Budibase/budibase/security/advisories/GHSA-j9fc-w3mr-x6mv","https://github.com/Budibase/budibase","https://github.com/Budibase/budibase/releases/tag/3.40.0"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-j9fc-w3mr-x6mv","url":"https://osv.dev/vulnerability/GHSA-j9fc-w3mr-x6mv"}],"summary":"Budibase: Privilege escalation via public role assignment API missing app-level authorization"}