CyberRota Analysis
AI-GeneratedBudibase versions prior to 3.40.0 are vulnerable to an authorization and authentication bypass in the changeTenantOwnerEmail endpoint, allowing any authenticated user, even those with minimal privileges, to change the tenant account-holder's email to one controlled by an attacker. This flaw can lead to account takeover through the public password-reset mechanism, granting full administrative access to the attacker. Organizations using self-hosted instances of Budibase should prioritize patching this vulnerability to prevent potential administrative account compromises.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted instances (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL set), the cloudRestricted middleware is a no-op and the route is protected only by a general authentication check, so any authenticated user — including a lowest-privilege BASIC app user — can reassign the tenant account-holder (top-privilege admin) email to an attacker-controlled address. The attacker can then use the public password-reset flow to take over the admin account, leading to full administrative access.