The Budibase server's email change workflow at POST /api/v2/email trusts a client-supplied accountId without verifying it matches the authenticated session's accountId. An attacker logged into their own account can supply a victim's accountId and an attacker-controlled email address to initiate an email change for the victim's account. The verification code is sent to the attacker-controlled email, allowing the attacker to complete the workflow and change the victim's email. Subsequently, the attacker uses the password reset endpoint to set a new password via the attacker-controlled email, achieving full account takeover. The vulnerability arises because the server only checks that the currentEmail matches the session but does not validate the accountId parameter against the session. The victim's accountId is not exposed in any public or authenticated API endpoints, requiring the attacker to obtain it out-of-band. This flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key).

An authenticated attacker who obtains a victim's accountId can fully take over the victim's Budibase account by changing the victim's login email to an attacker-controlled address and resetting the password. The attacker gains access to all tenant data, applications, and stored credentials associated with the victim's account. The victim is locked out of their account. The attack requires no victim interaction beyond the attacker having the victim's accountId, which is not exposed via normal API calls and must be obtained through other means.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to accountId values and monitor for suspicious email change requests. Avoid sharing accountId values externally and consider additional verification steps for email change workflows. Do not rely solely on client-supplied accountId values for authorization checks.