EUVD-2026-57426
GHSA-c8vc-7pv3-g98p
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
AV:N for account portal API; AC:H because victim accountId is not enumerable via normal API surfaces; PR:L for authenticated attacker; S:C for cross-account impact; A:N as availability is unaffected.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the authenticated session, while checking only currentEmail. An authenticated attacker who obtains a victim account identifier can start the email-change workflow for the victim, receive and submit the verification code through POST /api/v2/email/verification, move the victim email to an attacker-controlled address, and complete a password reset as the victim. This issue is fixed in version 3.40.0.
AnalysisAI
Full account takeover is possible in Budibase's account portal via an Insecure Direct Object Reference (IDOR) in the email-change API endpoint, affecting all versions prior to 3.40.0. POST /api/v2/email on account.budibase.app accepts a client-supplied accountId without binding it to the authenticated session - an authenticated attacker who obtains a victim's accountId UUID can redirect the email-change verification code to an attacker-controlled address, then complete a password reset to seize the victim's account entirely without any victim interaction required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid Budibase account (any tier, including free) to pass the session check on currentEmail - unauthenticated exploitation is not possible per the PR:L CVSS rating. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.2 score with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N accurately reflects the attack profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid free-tier Budibase account obtains a target user's accountId UUID through an out-of-band channel - for example, a support ticket exchange, a leaked screenshot, or a prior partial compromise - then sends a crafted POST /api/v2/email request substituting the victim's accountId while providing an attacker-controlled email address and the attacker's own currentEmail to pass the session check. The verification code arrives in the attacker's inbox; they submit it via POST /api/v2/email/verification, the victim's account email is permanently changed, and the attacker completes a password reset to the now-controlled address - achieving full account takeover with zero victim interaction. … |
| Remediation | Upgrade to Budibase 3.40.0 or later, which contains the fix for this vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Budibase instances and confirm which versions are deployed, prioritizing production account portal systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Authentication bypass in Budibase low-code platform (versions prior to 3.35.4) allows remote unauthenticated attackers t
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today