Executive brief
Budibase is an open-source low-code platform that allows users to build and deploy applications. A vulnerability in the account management portal enables a logged-in attacker to take over any victim account by changing the victim's email address to one they control, then resetting the password. This grants the attacker full access to the victim's applications, databases, stored credentials, and sensitive configuration, while locking the victim out of their own account.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the POST /api/v2/email endpoint on account.budibase.app. The endpoint validates the currentEmail field against the authenticated session but fails to validate that the accountId in the request body matches the authenticated user's accountId. An authenticated attacker who obtains a victim's accountId (through out-of-band channels, as it is not exposed in normal API endpoints) can submit a request to change the victim's email to an attacker-controlled address. The verification code is sent to the attacker's email, allowing the attacker to complete the workflow and change the victim's email permanently. The attacker then leverages the standard password-reset flow to set a new password and gain full account access. This chain is deterministic and requires no additional vulnerabilities. The fix is to validate body.accountId === session.accountId before processing email-change requests.
Affected products
- Budibase Budibase <3.40.0
Timeline
- 2026-07-24: disclosed
- 2026-07-24: patched: Fixed in version 3.40.0