Executive brief
A security flaw in Budibase's account portal allows an attacker to take over another user's account if they know the victim's internal account ID. By exploiting this, an attacker can change the victim's registered email address to one they control, effectively locking the original owner out and gaining full access to their apps, data, and credentials. This could lead to significant data exposure and loss of control over business applications built on the platform.
Technical details
An Insecure Direct Object Reference (IDOR) exists in the `POST /api/v2/email` endpoint of the Budibase account portal. The server fails to validate that the `accountId` provided in the request body matches the `accountId` of the authenticated session. While the application checks that the `currentEmail` field matches the session, an attacker can provide their own email as `currentEmail` and a victim's UUID as the `accountId`. This allows the attacker to redirect the email-change verification process to an attacker-controlled address. Once the email is changed, the attacker can use the standard password reset flow to gain full account access. Exploitation requires the attacker to obtain the victim's internal `accountId` UUID, which is not exposed through standard public APIs.
Affected products
- Budibase budibase <= 3.38.1
Timeline
- 2026-07-22: disclosed
- 2026-07-24: advisory: GitHub Advisory published
- 2026-07-24: patched: Fixed in version 3.40.0