VULNERABILITY INTELLIGENCE

CVE-2026-72856

CVSS score8.6 HIGH

EPSS probability0.47%

CISA KEVNot currently listed

Published2026-08-13

Last modified2026-08-31

Description

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted instances (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL set), the cloudRestricted middleware is a no-op and the route is protected only …