Executive brief
Budibase is a low-code application platform used to build internal tools and applications. A flaw in the tenant owner email change feature allows any logged-in user—even those with minimal privileges—to reassign the administrator's email address to an attacker's email, then use password reset to hijack the admin account and gain full system control, including access to all application data and server credentials.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the PUT /api/global/users/tenant/owner endpoint. On self-hosted instances where SELF_HOSTED or DISABLE_ACCOUNT_PORTAL environment variables are set, the cloudRestricted middleware becomes a no-op, leaving only a general authentication check to protect the route. This allows any authenticated user—including BASIC-level app users—to call the endpoint with arbitrary originalEmail and newAccountEmail parameters. The handler then sets isAccountHolder:true and allowChangingEmail:true, bypassing normal admin protection. An attacker can then exploit the weak password recovery mechanism (CWE-640) by requesting a password reset on the attacker-controlled email address, receiving a reset link that grants full account takeover. Network-accessible, low-privilege authentication required, no user interaction needed.
Affected products
- Budibase Budibase before 3.40.0
Timeline
- 2026-07-22: disclosed
- 2026-07-22: patched: version 3.40.0 released
- 2026-08-13: advisory