The vulnerability exploits an IDOR flaw in Budibase’s email change endpoint. The POST /api/v2/email API accepts a client‑supplied accountId that is not bound to the authenticated session, while only validating the currentEmail field. Because of this, a user who is logged in and knows another user’s account identifier can initiate the email change workflow for that victim. After receiving the verification code and transitioning the victim’s email address to one controlled by the attacker, the attacker can then perform a password reset as the victim. This sequence allows full compromise of the victim account, including possession of the account’s email and credentials.

Budibase, version 3.40.0 and earlier are affected. Any deployment of Budibase that runs a version prior to 3.40.0 is vulnerable if the POST /api/v2/email endpoint is exposed and can accept client supplied accountId values. The vulnerability is present in all releases before 3.40.0, regardless of additional feature flags or deployments.

The CVSS score of 8.2 reflects a high severity and indicates that the vulnerability can be exploited by any authenticated user who can obtain another user’s account identifier. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers likely gain access either through other authentication mechanisms or by abusing a separate endpoint that reveals account identifiers. Once the attacker has the accountId, they can change the victim’s email address and reset the password, resulting in account takeover.