CyberRota Analysis
AI-GeneratedBudibase versions prior to 3.40.0 are vulnerable to an authentication bypass in the email change workflow, allowing authenticated attackers to manipulate account identifiers. By exploiting this flaw, an attacker can redirect a victim's email to their own address, enabling them to reset the victim's password and gain unauthorized access. Organizations using Budibase should prioritize upgrading to version 3.40.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the authenticated session, while checking only currentEmail. An authenticated attacker who obtains a victim account identifier can start the email-change workflow for the victim, receive and submit the verification code through POST /api/v2/email/verification, move the victim email to an attacker-controlled address, and complete a password reset as the victim. This issue is fixed in version 3.40.0.