CVE-2026-73303

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.40.0

Description An issue exists where the endpoint "/api/v2/email" accepts a client-controlled accountId without binding it to the authenticated session, verifying only the currentEmail. An authenticated attacker with a victim's account identifier can initiate an email-change workflow, submit a verification code via the "/api/v2/email/verification" endpoint, change the victim's email to one controlled by the attacker, and subsequently perform a password reset to gain full account access.

Recommendations Update to version 3.40.0.