CVE-2026-73303 in Budibase
Summary
by MITRE • 08/12/2026
Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the authenticated session, while checking only currentEmail. An authenticated attacker who obtains a victim account identifier can start the email-change workflow for the victim, receive and submit the verification code through POST /api/v2/email/verification, move the victim email to an attacker-controlled address, and complete a password reset as the victim. This issue is fixed in version 3.40.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability exists within Budibase's authentication and account management system where the platform fails to properly validate account ownership during email change operations. The flaw manifests in the POST /api/v2/email endpoint which accepts a client-controlled accountId parameter without establishing proper binding to the authenticated user session. This represents a critical authorization bypass vulnerability that allows attackers to manipulate email addresses associated with other accounts without proper authentication. The vulnerability stems from inadequate input validation and session management controls that should have enforced strict account ownership verification before permitting email modification operations.
The technical implementation of this flaw enables an authenticated attacker to exploit the lack of session binding by constructing malicious requests that target specific victim account identifiers. When an attacker obtains a valid victim account ID through various means such as enumeration or prior reconnaissance, they can initiate the email change workflow for that account without needing legitimate access credentials. The system only validates the currentEmail field during the initial request but fails to verify that the requested accountId belongs to the authenticated user making the request. This creates an authorization gap where session context does not properly constrain the account operations that can be performed.
The operational impact of this vulnerability is severe as it enables full account takeover capabilities through a multi-step attack process. An attacker who successfully exploits this vulnerability can first initiate the email change workflow for a victim account, then intercept and submit verification codes to complete the email address modification. Once the victim's email address has been changed to an attacker-controlled address, the attacker can then initiate password reset requests using that compromised email address, effectively gaining complete control over the victim's account. This constitutes a privilege escalation attack vector that transforms legitimate authentication into unauthorized account takeover through manipulation of email verification workflows.
The vulnerability aligns with CWE-285 (Improper Authorization) and represents a classic session management weakness where user context is not properly enforced during sensitive operations. It also maps to ATT&CK technique T1566 (Phishing) as the attack chain relies on manipulating email addresses to facilitate credential compromise, and T1078 (Valid Accounts) since it leverages legitimate authentication sessions to perform unauthorized actions. The fix implemented in version 3.40.0 addresses this by enforcing strict session binding where the accountId parameter must be validated against the authenticated user's session context before allowing any email modification operations to proceed.
Organizations should implement comprehensive input validation controls that enforce proper session binding for all account management operations, particularly those involving credential-related changes such as email addresses and passwords. The fix demonstrates the importance of implementing robust authorization checks that validate not just the existence of requested resources but also the proper ownership context within which operations are performed. Security teams should ensure that all authenticated endpoints validate that client-provided identifiers match the authenticated user session to prevent similar authorization bypass vulnerabilities. Additionally, implementing rate limiting and monitoring for email change operations can help detect anomalous activity patterns that might indicate exploitation attempts.
This vulnerability highlights the critical importance of proper session management and input validation in authentication systems. The flaw demonstrates how seemingly minor oversights in authorization logic can create significant security risks that enable full account compromise. Organizations should conduct regular security reviews of their authentication flows to ensure that all account modification operations properly validate user context and enforce appropriate access controls. The implementation of automatic session binding checks for sensitive operations, combined with proper logging and monitoring capabilities, provides essential protection against this class of authorization bypass attacks. Organizations using Budibase or similar platforms should prioritize upgrading to version 3.40.0 and conduct thorough security assessments of their authentication workflows to identify and remediate similar vulnerabilities that might exist in other components of their systems.