Skip to main content

Budibase CVE-2026-72856

| EUVDEUVD-2026-58505 HIGH
Weak Password Recovery Mechanism for Forgotten Password (CWE-640)
2026-08-13 disclosure@vulncheck.com GHSA-796c-884r-78pp
Authentication Bypass
8.6
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
8.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.6 CRITICAL

Network-exploitable by any authenticated user (PR:L); scope changes to full admin context (S:C); high C and I reflect complete tenant admin takeover; no availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 13, 2026 - 23:04 EUVD
Analysis Generated
Aug 13, 2026 - 22:37 vuln.today
CVE Published
Aug 13, 2026 - 22:17 cve.org
HIGH 8.6

DescriptionCVE.org

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted instances (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL set), the cloudRestricted middleware is a no-op and the route is protected only by a general authentication check, so any authenticated user - including a lowest-privilege BASIC app user - can reassign the tenant account-holder (top-privilege admin) email to an attacker-controlled address. The attacker can then use the public password-reset flow to take over the admin account, leading to full administrative access.

AnalysisAI

Tenant admin account takeover in Budibase self-hosted deployments before 3.40.0 is achievable by any authenticated user, including the lowest-privilege BASIC app user. The PUT /api/global/users/tenant/owner endpoint fails to enforce the cloudRestricted middleware on self-hosted instances where SELF_HOSTED or DISABLE_ACCOUNT_PORTAL is set, allowing any valid session to silently reassign the tenant owner email address to an attacker-controlled value. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate as any low-privilege BASIC Budibase user
Delivery
Send PUT /api/global/users/tenant/owner with attacker-controlled email
Exploit
Exploit no-op cloudRestricted middleware on self-hosted instance
Execution
Submit public password-reset for newly assigned admin email
Persist
Receive password-reset link and set new admin credentials
Impact
Achieve full tenant administrative takeover
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a self-hosted Budibase deployment where the SELF_HOSTED environment variable is set to true or DISABLE_ACCOUNT_PORTAL is enabled-both are default conditions for any operator running Budibase outside Budibase's managed cloud. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This vulnerability carries a high actual risk that is well-calibrated against its CVSS 4.0 score of 8.6. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker holding any valid Budibase account-obtained through self-registration, a shared credential, or a compromised low-privilege employee account-sends a single authenticated PUT request to /api/global/users/tenant/owner specifying an attacker-controlled email as the new tenant owner; the no-op cloudRestricted middleware allows the request through on self-hosted instances. The attacker then submits a public password-reset request for that email address, receives the reset link, and completes the standard reset flow. …
Remediation Upgrade all self-hosted Budibase instances to version 3.40.0 or later; this is the vendor-confirmed fix per GitHub Security Advisory GHSA-j82g-67x3-xcwh (https://github.com/Budibase/budibase/security/advisories/GHSA-j82g-67x3-xcwh). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all Budibase self-hosted instances and current versions; restrict or disable BASIC user account access immediately to prevent exploitation; monitor /api/global/users/tenant/owner endpoint for suspicious PUT requests. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-640 – Weak Password Recovery Mechanism for Forgotten Password

View all
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-7615 HIGH POC
8.8
CVE-2017-8295 MEDIUM POC
5.9
CVE-2025-6216 CRITICAL POC
9.8
CVE-2025-47646 CRITICAL POC
9.8
CVE-2015-7257 HIGH POC
7.5
CVE-2026-18963 CRITICAL POC
9.1
CVE-2022-50910 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-72856 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy