Authorization Bypass Vulnerability in Budibase by Budibase

CVE-2026-72856

What is CVE-2026-72856?

In Budibase versions prior to 3.40.0, a vulnerability exists within the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. This issue permits authenticated users, even with minimal privileges, to bypass proper authorization mechanisms. Specifically, when self-hosted configurations are in use, the cloudRestricted middleware is ineffective, exposing a flaw where an attacker can change the email of a tenant account-holder to an address they control. By exploiting this flaw, the attacker can utilize the public password-reset functionality, enabling them to seize control of the administrator account, resulting in comprehensive administrative access.

References