Description

Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the authenticated session, while checking only currentEmail. An authenticated attacker who obtains a victim account identifier can start the email-change workflow for the victim, receive and submit the verification code through POST /api/v2/email/verification, move the victim email to an attacker-controlled address, and complete a password reset as the victim. This issue is fixed in version 3.40.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-12T20:17:54.133Z",
  "pubdate": "2026-08-12T20:17:54.133Z",
  "executiveSummary": "An account takeover vulnerability exists in Budibase prior to version 3.40.0, specifically within the email update workflow accessible via the endpoint POST /api/v2/email on account.budibase.app. The flaw allows an authenticated attacker to manipulate user account parameters by supplying a client-controlled accountId that is not cryptographically or logically bound to the currently authenticated user session. The security control implemented in the application relies solely on verifying the currentEmail parameter, failing to validate whether the target account identifier matches the authenticated actor context. Consequently, an attacker capable of obtaining a victim's account identifier can initiate an unauthorized email modification process, intercept the verification workflow via POST /api/v2/email/verification, reassign the victim's registered email address to an attacker-controlled endpoint, and subsequently execute a password reset to achieve complete account compromise. The impact includes full session hijacking, loss of data integrity, and unauthorized administrative access depending on the victim's privilege level. Exploitation requires authenticated access to the platform and prior acquisition of the victim account identifier. This security deficiency is fully resolved in Budibase version 3.40.0 through proper session-to-account binding and enhanced parameter validation.",
  "technicalDetails": "The vulnerability resides in the email modification subsystem of Budibase prior to version 3.40.0, specifically exposed through the REST API endpoint POST /api/v2/email and its corresponding validation handler POST /api/v2/email/verification on account.budibase.app. The root cause of the vulnerability stems from inadequate input validation and missing server-side session binding logic regarding the accountId parameter. When an authenticated user initiates an email change request, the application accepts the accountId directly from the client request without enforcing a strict cryptographic or logical validation check to ensure that the supplied account identifier corresponds exclusively to the currently authenticated session context. Instead, the backend logic executes authorization checks solely against the currentEmail parameter, creating a significant authorization bypass vector.\nTo exploit this flaw, an authenticated attacker must first acquire a target victim's account identifier. Armed with this information, the attacker crafts a malicious HTTP POST request to POST /api/v2/email, injecting the victim's accountId while supplying an attacker-controlled destination email address. Because the backend fails to bind the session identifier to the requested accountId, the application processes the request and initiates the email-change workflow on behalf of the victim. The system generates a verification code and dispatches it through the configured notification channel. The attacker then intercepts or receives this verification token and submits it to the POST /api/v2/email/verification endpoint. Upon successful verification, the backend updates the victim's account record, permanently moving the victim's registered email address to the attacker-controlled address.\nFollowing the successful email migration, the attacker initiates the platform's standard password reset functionality. Since the victim's account is now associated with the attacker's email address, the password reset token is delivered directly to the attacker. The attacker uses this token to establish a new password for the victim account, effectively locking out the legitimate user and achieving complete account takeover. The attack requires network exposure to the Budibase API, an active low-privilege or standard authenticated attacker session, and valid knowledge of the victim's account identifier. The vulnerability impacts confidentiality, integrity, and availability across affected deployments, granting the adversary persistent unauthorized access to the victim's resources and workspaces."
}