Builder-to-admin escalation via unchecked onboard role assignment

Privilege escalation in Budibase before 3.38.1 allows remote authenticated users with builder access to create a global admin account. The onboardUsers route admits builders, then bulkCreate writes unchecked admin and builder fields supplied through the request body. Exploitation requires a self-hosted instance without SMTP configuration; the generated password grants immediate control of the new global administrator account.