Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck

CVE-2026-72856Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email

High 8.1

In plain English

A high-severity security flaw in budibase from Budibase. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 58.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted instances (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL set), the cloudRestricted middleware is a no-op and the route is protected only by a general authentication check, so any authenticated user — including a lowest-privilege BASIC app user — can reassign the tenant account-holder (top-privilege admin) email to an attacker-controlled address. The attacker can then use the public password-reset flow to take over the admin account, leading to full administrative access.

Affected products (as reported)

Vendor	Product	Versions
Budibase	budibase	0 – before 3.40.0

Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-j82g-67x3-xcwh) vendor-advisory
VulnCheck Advisory: Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email third-party-advisory