HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-72856 — Budibase versions before 3.40.0 contain an authorization/authentication bypass i...

·Source: NIST NVD

Updated:

Executive Summary

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted instances (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL set), the cloudRestricted middleware is a no-op and the route is protected only by a general authentication check, so any authenticated user — including a lowest-privilege BASIC ap

Analysis

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted instances (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL set), the cloudRestricted middleware is a no-op and the route is protected only by a general authentication check, so any authenticated user — including a lowest-privilege BASIC app user — can reassign the tenant account-holder (top-privilege admin) email to an attacker-controlled address. The attacker can then use the public password-reset flow to take over the admin account, leading to full administrative access. CVSS Score: 8.1. Published: 2026-08-13T22:17:24.893.

Indicators of Compromise (1)

CVE (1)
CVE-2026-72856
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 13, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Financial data startup Quatr raises $18 million

Quartr, the world's leading first-party data layer for institutional finance and AI, today announced it has closed a $18 million funding round, led by existing investor Altos Ventures with participation from new investor SEB (publ.)

Finextra
LOWVulnerabilityNEW

300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw

Tracked as CVE-2026-15748, the arbitrary file upload bug allows unauthenticated attackers to upload executable files. The post 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw appeared first on SecurityWeek .

CVE-2026-15748
SecurityWeek
LOWVulnerability

Confluence adds AI-enabled automation to its product suite.

Confluence Technologies, Inc. (“Confluence”), a global leader in regulatory, analytics, and investor communications solutions for the investment management industry, today announced the launch of Confluence POINT, AI-enabled automation that optimizes workflows across its solutions.

Finextra