EUVD-2026-57426
GHSA-c8vc-7pv3-g98p
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
AV:N for account portal API; AC:H because victim accountId is not enumerable via normal API surfaces; PR:L for authenticated attacker; S:C for cross-account impact; A:N as availability is unaffected.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the authenticated session, while checking only currentEmail. An authenticated attacker who obtains a victim account identifier can start the email-change workflow for the victim, receive and submit the verification code through POST /api/v2/email/verification, move the victim email to an attacker-controlled address, and complete a password reset as the victim. This issue is fixed in version 3.40.0.
AnalysisAI
Full account takeover is possible in Budibase's account portal via an Insecure Direct Object Reference (IDOR) in the email-change API endpoint, affecting all versions prior to 3.40.0. POST /api/v2/email on account.budibase.app accepts a client-supplied accountId without binding it to the authenticated session - an authenticated attacker who obtains a victim's accountId UUID can redirect the email-change verification code to an attacker-controlled address, then complete a password reset to seize the victim's account entirely without any victim interaction required. No public exploit code has been identified at time of analysis; the vulnerability is fixed in Budibase 3.40.0.
Technical ContextAI
The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the POST /api/v2/email endpoint on the Budibase account portal validates the currentEmail field against the session to prevent trivial misuse, but never enforces that the body-supplied accountId matches session.accountId. Because the legitimate frontend always submits the logged-in user's own accountId, the server-side trust assumption went undetected in normal use. The attack exploits the email-change workflow in two sequential API calls - POST /api/v2/email to initiate and POST /api/v2/email/verification to confirm - both operating on the attacker-supplied accountId. The affected package is npm/@budibase/server (CPE: cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*). The IDOR is more impactful than a direct password reset because the existing PUT /api/v2/auth/password reset link is delivered to the address on the account - which the attacker does not control - whereas this vulnerability allows the attacker to move the victim's email address first, then receive the reset link.
RemediationAI
Upgrade to Budibase 3.40.0 or later, which contains the fix for this vulnerability. Release artifacts are available at https://github.com/Budibase/budibase/releases/tag/3.40.0. For organizations unable to patch immediately, restrict network access to the account portal (account.budibase.app) to trusted IP ranges via firewall or API gateway rules - this reduces the attack surface to internal actors, with the trade-off of blocking remote legitimate email-change requests. If self-hosting, disabling or WAF-blocking POST /api/v2/email entirely until the upgrade is applied eliminates the attack vector at the cost of preventing all email changes for users. Monitoring for email-change API calls where the submitted accountId does not match the session's accountId can serve as a detection control, though it requires custom logging instrumentation. No workaround fully substitutes for the patch.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaS
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Unauthenticated account takeover of pending invited users in Budibase Server (@budibase/server) versions 3.41.0 through
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today