CVE-2026-72856

HighCVSS 8.1

Published: 13/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

Budibase before 3.40.0 contains an authorization/authentication bypass in the PUT /api/global/users/tenant/owner endpoint. On self-hosted instances, any authenticated user, including a lowest-privilege BASIC app user, can reassign the tenant account-holder email to an attacker-controlled address. The attacker can then use the public password-reset flow to take over the admin account, leading to full administrative access.

Risk Assessment

The risk includes complete takeover of the admin account and full control over the platform, potentially leading to severe security breaches and data loss.

Recommendation

Immediately upgrade Budibase to version 3.40.0 or later to remediate the vulnerability.

Original NVD description (English source)

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted instances (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL set), the cloudRestricted middleware is a no-op and the route is protected only by a general authentication check, so any authenticated user — including a lowest-privilege BASIC app user — can reassign the tenant account-holder (top-privilege admin) email to an attacker-controlled address. The attacker can then use the public password-reset flow to take over the admin account, leading to full administrative access.