CVE-2026-72856— Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email
Quick assessment
Affected
Budibase budibase
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Budibase是英国Budibase公司开源的一个低代码应用开发平台。 Budibase 3.40.0之前版本存在授权问题漏洞，该漏洞源于PUT /api/global/users/tenant/owner (changeTenantOwnerEmail)端点存在授权/身份验证绕过，由于自托管实例中cloudRestricted中间件不生效且路由仅受常规身份验证保护，可能导致任何已认证用户（包括最低权限的BASIC应用用户）将租户账号管理员邮箱重新分配至攻击者控制的地址，进而攻击者可利用公开的密码重置流
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-72856
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email
Source: CVE Program / CVE List V5
Vulnerability Description
Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted instances (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL set), the cloudRestricted middleware is a no-op and the route is protected only by a general authentication check, so any authenticated user — including a lowest-privilege BASIC app user — can reassign the tenant account-holder (top-privilege admin) email to an attacker-controlled address. The attacker can then use the public password-reset flow to take over the admin account, leading to full administrative access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
忘记口令恢复机制弱
Source: CVE Program / CVE List V5
Vulnerability Title
Budibase 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Budibase是英国Budibase公司开源的一个低代码应用开发平台。 Budibase 3.40.0之前版本存在授权问题漏洞，该漏洞源于PUT /api/global/users/tenant/owner (changeTenantOwnerEmail)端点存在授权/身份验证绕过，由于自托管实例中cloudRestricted中间件不生效且路由仅受常规身份验证保护，可能导致任何已认证用户（包括最低权限的BASIC应用用户）将租户账号管理员邮箱重新分配至攻击者控制的地址，进而攻击者可利用公开的密码重置流
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-72856
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Verified env
Premium
Reproduced successfully in a real sandbox
· Below is the actual recording of building the environment and exploiting the vulnerability.
Reproduction recording is a Pro+ exclusive
Watch the full sandbox build + live exploit recording for this CVE. Limited-time ¥499/mo.
Upgrade to Pro+
Qwen3.6-35B-A3B
· 9643 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-72856
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-72856 (2)
Same Patch Batch · Budibase · 2026-08-13 · 13 CVEs total
| CVE-2026-72851 | 10.0 CRITICAL | Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook |
| CVE-2026-72850 | 9.1 CRITICAL | Budibase before 3.40.0 Arbitrary File Write via Path Traversal |
| CVE-2026-73302 | 9.0 CRITICAL | Budibase: OIDC SSO account takeover: incoming identity linked by email without checking em |
| CVE-2026-73305 | 8.8 HIGH | Budibase: Privilege escalation via public role assignment API missing app-level authorizat |
| CVE-2026-72855 | 8.5 HIGH | Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST |
| CVE-2026-73618 | 8.3 HIGH | Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter |
| CVE-2026-72857 | 7.7 HIGH | Budibase before 3.40.0 Credential Exposure via STRING Fields |
| CVE-2026-72849 | 7.7 HIGH | Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF |
| CVE-2026-72853 | 7.6 HIGH | Budibase before 3.40.0 SQL Injection via Oracle connector |
| CVE-2026-73408 | 7.6 HIGH | Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector |
| CVE-2026-73617 | 7.1 HIGH | Budibase before 3.40.0 NoSQL Injection via MongoDB datasource |
| CVE-2026-73304 | 4.9 MEDIUM | Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users |
IV. Related Vulnerabilities
Same product: budibase
-
CVE-2026-54356
Budibase authenticated arbitrary S3 signed upload URL issuan -
CVE-2026-35219
Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, S -
CVE-2026-73410
Budibase: SSRF via DNS rebinding in the REST datasource inte -
CVE-2026-64657
Budibase: Database Connector SQL Injections in PostgreSQL, M -
CVE-2026-73305
Budibase: Privilege escalation via public role assignment AP
Same vendor: Budibase
-
CVE-2026-100688
Budibase server before 3.45.0 Cross-Tenant Information Discl -
CVE-2026-100687
Budibase Server before 3.45.0 Credential Exposure via Extern -
CVE-2026-100686
Budibase before 3.45.0 Cross-Workspace Privilege Escalation -
CVE-2026-100685
Budibase before 3.45.0 Information Disclosure via Chat Links -
CVE-2026-100684
Budibase Server 3.41.0 before 3.45.0 Authentication Bypass v
Same weakness: CWE-640
-
CVE-2026-102115
Kiteworks Core Authentication Bypass in the Password Reset W -
CVE-2026-101188
Netcore POWER13 ubus routerd.passwd_set password recovery -
CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 A -
CVE-2026-93340
Gladys Assistant < 5.1.0 Password Reset Link Poisoning via f -
CVE-2026-93453
SOGo before 5.12.11 Password Reset Token Interception via Or
V. Comments for CVE-2026-72856
No comments yet