CVE-2026-73303 Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)
Authenticated attackers can take over victim accounts by manipulating the email change workflow due to missing session validation on the account ID.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73303?
CVE-2026-73303 is a high-severity authentication bypass vulnerability in budibase, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the authenticated session, while checking only currentEmail. An authenticated attacker who obtains a victim account identifier can start the email-change workflow for the victim, receive and submit the verification code through POST /api/v2/email/verification, move the victim email to an attacker-controlled address, and complete a password reset as the victim. This issue is fixed in version 3.40.0.
Weakness: CWE-639
Which versions are affected by CVE-2026-73303?
2 open source packages ship an affected version, including @budibase/server.
| Package | Affected | Fixed in |
|---|---|---|
@budibase/server npm | All versions to 3.38.1 | None |
@budibase/server npm | All versions to 3.38.1 | None |
How do I fix CVE-2026-73303?
No fix has been published for CVE-2026-73303 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-73303 being exploited?
There is no known exploitation of CVE-2026-73303 in the wild and no public exploit code.
Sources
Also known as GHSA-c8vc-7pv3-g98p.