CVE-2026-72856

Received Received - Intake

Authorization Bypass in Budibase Self-Hosted

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted instances (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL set), the cloudRestricted middleware is a no-op and the route is protected only by a general authentication check, so any authenticated user — including a lowest-privilege BASIC app user — can reassign the tenant account-holder (top-privilege admin) email to an attacker-controlled address. The attacker can then use the public password-reset flow to take over the admin account, leading to full administrative access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72856

EUVD

EUVD-2026-58505

Affected Vendors & Products

Vendor	Product	Version / Range
budibase	budibase	to 3.40.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-640	The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

Executive Summary

Budibase versions before 3.40.0 have an authorization bypass in the PUT /api/global/users/tenant/owner endpoint. This allows any authenticated user, even with basic privileges, to change the tenant account-holder's email address to an attacker-controlled one. The attacker can then reset the admin password via the public flow and gain full administrative access.

Detection Guidance

To detect this vulnerability, check if your Budibase instance is running a version before 3.40.0. Verify the PUT /api/global/users/tenant/owner endpoint behavior and ensure cloudRestricted middleware is not bypassed. Review logs for unauthorized tenant owner email changes.

Impact Analysis

If you use a self-hosted Budibase instance before version 3.40.0, an attacker with basic access could escalate privileges to admin, take over the account, and gain full control over your Budibase deployment and data.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements for GDPR, HIPAA, and other regulations that mandate strict access controls and data protection.

Mitigation Strategies

Upgrade Budibase to version 3.40.0 or later immediately. If upgrading is not possible, restrict access to the PUT /api/global/users/tenant/owner endpoint and monitor for suspicious activity. Disable low-privilege user access to sensitive endpoints.

Hi! I’m here to help you understand CVE-2026-72856. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70