CVE-2026-72856 in Budibase
Summary
by MITRE • 08/14/2026
Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted instances (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL set), the cloudRestricted middleware is a no-op and the route is protected only by a general authentication check, so any authenticated user — including a lowest-privilege BASIC app user — can reassign the tenant account-holder (top-privilege admin) email to an attacker-controlled address. The attacker can then use the public password-reset flow to take over the admin account, leading to full administrative access.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability exists in Budibase versions prior to 3.40.0 and represents a critical authorization bypass that allows low-privilege users to escalate their privileges to full administrative control. The flaw is specifically located within the PUT /api/global/users/tenant/owner endpoint, which is designed to change the tenant owner email address. In self-hosted deployment configurations where either the SELF_HOSTED or DISABLE_ACCOUNT_PORTAL environment variables are set, the cloudRestricted middleware component fails to function as intended, effectively disabling its protective mechanisms. This creates a dangerous situation where the endpoint relies solely on a basic authentication check rather than proper authorization controls, allowing any authenticated user regardless of their privilege level to manipulate tenant ownership settings.
The technical implementation of this vulnerability stems from an improper security control design where the cloudRestricted middleware is intentionally disabled in self-hosted environments but fails to properly validate the request context. When these environment variables are present, the middleware becomes a no-op function that does not enforce any additional restrictions beyond basic authentication. This design flaw means that legitimate security controls meant to prevent unauthorized privilege escalation are completely bypassed, leaving the system vulnerable to exploitation by users with minimal access rights. The vulnerability is particularly concerning because it operates at the core administrative level of the application's user management system, where tenant ownership represents the highest possible privilege within the platform.
The operational impact of this vulnerability is severe and potentially catastrophic for organizations using affected versions of Budibase. An attacker who gains access to any authenticated user account, even one with basic application privileges, can execute a complete takeover of the administrative account by simply changing the tenant owner email address to their own controlled email address. This attack vector leverages the platform's legitimate password reset functionality, which is designed for recovery purposes but becomes exploitable when combined with the authorization bypass. The attacker can then use the public password reset flow to gain full administrative access to the system, effectively compromising the entire application environment and potentially all data stored within it. This type of privilege escalation directly violates fundamental security principles and represents a critical failure in the principle of least privilege enforcement.
Organizations should immediately upgrade to Budibase version 3.40.0 or later to resolve this vulnerability, as the fix addresses the core issue by properly enforcing authorization controls even in self-hosted environments. The mitigation strategy involves ensuring that all authenticated requests to the tenant owner email change endpoint are properly validated against appropriate authorization levels rather than relying solely on basic authentication checks. Security teams should also implement monitoring for unauthorized changes to tenant ownership settings and review access controls within their deployment configurations to identify any potential misconfigurations that might expose similar vulnerabilities. This vulnerability aligns with CWE-285, which addresses improper authorization in software systems, and represents a clear violation of the ATT&CK technique T1078 for Valid Accounts and T1566 for Phishing, where the initial compromise can lead to full administrative control through legitimate system functions. The remediation process should include comprehensive security testing of all endpoints that handle privileged operations to ensure similar authorization bypasses are not present in other parts of the application.