CVE-2026-73303 Overview
CVE-2026-73303 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in Budibase, an open-source low-code platform. Versions prior to 3.40.0 accept a client-controlled accountId in the POST /api/v2/email endpoint on account.budibase.app without binding it to the authenticated session. The endpoint validates only currentEmail, allowing an authenticated attacker who knows a victim's account identifier to initiate an email-change workflow against that account. The attacker can then complete verification, redirect the victim's email to an attacker-controlled address, and perform a password reset to take over the account. Budibase resolved the issue in version 3.40.0.
Critical Impact
An authenticated attacker with knowledge of a victim's accountId can hijack the email-change workflow and complete a full account takeover through password reset.
Affected Products
- Budibase versions prior to 3.40.0
- account.budibase.app hosted service (pre-patch)
- Self-hosted Budibase deployments running affected releases
Discovery Timeline
- 2026-08-12 - CVE-2026-73303 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-73303
Vulnerability Analysis
The vulnerability resides in the account email-change workflow exposed by POST /api/v2/email. The endpoint accepts an accountId parameter supplied by the client and pairs it with a currentEmail check to authorize the state transition. Because the server never validates that the submitted accountId matches the session principal, any authenticated user can request an email change for another account whose identifier and current email they know.
After the initial request, the attacker submits a verification code through POST /api/v2/email/verification to complete the email change. Once the victim's account is bound to an attacker-controlled address, the attacker triggers a standard password reset. The reset link is delivered to the attacker's mailbox, granting full authenticated access to the victim's account and its associated tenants, applications, and data.
Root Cause
The root cause is missing authorization on a state-changing resource identifier [CWE-639]. The accountId parameter is treated as trusted user input rather than being derived from the authenticated session. Combining a client-controlled object reference with a weak secondary check (currentEmail) collapses the authorization boundary between accounts.
Attack Vector
Exploitation requires network access to the Budibase account service and valid authenticated credentials for any account on the platform. The attacker must also obtain the target accountId and current email, which may be exposed through error messages, prior interactions, or reconnaissance. No user interaction from the victim is required, since the entire workflow is driven server-side by the attacker's requests.
No public proof-of-concept code has been released. Refer to the GitHub Security Advisory GHSA-c8vc-7pv3-g98p for maintainer analysis.
Detection Methods for CVE-2026-73303
Indicators of Compromise
- Requests to POST /api/v2/email where the session user identifier does not match the submitted accountId.
- Successful POST /api/v2/email/verification events followed by password reset requests within a short interval.
- Account email addresses changing to unfamiliar external domains without a corresponding support ticket or user-initiated action.
Detection Strategies
- Correlate authentication session identity against the accountId field in email-change API traffic to flag mismatches.
- Alert on password resets that occur immediately after an email change on the same account.
- Baseline the frequency of email-change workflows per tenant and alert on anomalous spikes.
Monitoring Recommendations
- Enable verbose audit logging for /api/v2/email and /api/v2/email/verification endpoints.
- Forward account service logs to a centralized SIEM for cross-account correlation and long-term retention.
- Monitor outbound email-verification messages for delivery to addresses outside expected corporate domains.
How to Mitigate CVE-2026-73303
Immediate Actions Required
- Upgrade Budibase to version 3.40.0 or later on all self-hosted and managed deployments.
- Audit account email-change and password-reset events for the period preceding the upgrade and validate any changes with account owners.
- Force password resets and revoke active sessions for accounts showing suspicious email changes.
Patch Information
The fix is included in Budibase 3.40.0. The patched version binds the accountId used in the email-change workflow to the authenticated session, preventing cross-account manipulation. Consult the GitHub Security Advisory GHSA-c8vc-7pv3-g98p for maintainer guidance.
Workarounds
- Restrict access to the account service via network controls until the patch is deployed.
- Require multi-factor authentication on all Budibase accounts to raise the cost of downstream password-reset abuse.
- Rotate account identifiers or credentials that may have been exposed through logs or third-party integrations.
# Configuration example: verify the running Budibase version is patched
docker inspect budibase/budibase --format '{{ .Config.Image }}'
# Upgrade to 3.40.0 or later
docker pull budibase/budibase:3.40.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
