Budibase versions prior to 3.40.0 expose a critical authentication flaw in the tenant owner email change endpoint. Because the cloudRestricted middleware is effectively disabled on self‑hosted setups, any authenticated user, even one with the lowest privilege, can reuse the endpoint to change the tenant’s account‑holder email to an address controlled by the attacker. This owner‑email flip enables the attacker to trigger the publicly available password‑reset flow and subsequently take full control of the administrative account, compromising the entire instance. The weakness is classified as CWE‑640, reflecting an authorization bypass that elevates privileges. The description does not detail the password‑reset exploitation step, so this downstream admin takeover is inferred from the stated capabilities.

All self‑hosted deployments of Budibase whose version is below 3.40.0 and that have the SELF_HOSTED or DISABLE_ACCOUNT_PORTAL options enabled. The vulnerability resides in the PUT /api/global/users/tenant/owner endpoint, which is available only when the application is run in a self‑hosted configuration.

The CVSS score of 8.6 signals high severity, and the absence of an EPSS value means there is currently no public metric for exploit likelihood. Because the bug requires an already‑authenticated user to make the request, the attack vector is limited to users who can log in to the system. Nevertheless, any authenticated user can modify the tenant owner email, creating a straightforward path to full administrative takeover once the password‑reset mechanism is invoked. The vulnerability is not listed in the CISA KEV catalog, indicating that no mass exploitation campaign has yet been reported, but the combination of a high CVSS score and the ease of use makes it a high‑risk issue for impacted installations. The indication that the attack can be performed by any authenticated user and that this can lead to full administrative takeover is inferred, as the CVE description focuses on the email change capability but does not explicitly mention the password‑reset exploitation step.