CVE-2026-73303 Budibase CVE debrief

Who should care

Budibase administrators and users should assess their exposure and verify their version. Defenders should prioritize upgrading to version 3.40.0 and monitoring for suspicious activities.

Why it matters

CVE-2026-73303 is a high-severity vulnerability in Budibase that allows an authenticated attacker to change the email address of a victim user and potentially reset their password. Defenders should prioritize upgrading to version 3.40.0 and monitoring for suspicious activities.

• An attacker can change the email address of a victim user
• An attacker can potentially reset the password of a victim user
• Defenders need to verify their Budibase version and upgrade if necessary
• Defenders should monitor for suspicious email change and password reset activities

Technical summary

CVE-2026-73303 is a high-severity vulnerability in Budibase, an open-source low-code platform. Prior to version 3.40.0, an authenticated attacker can exploit the vulnerability to change the email address of a victim user and potentially reset their password. The vulnerability is caused by the platform's handling of client-controlled account IDs without proper binding to the authenticated session. This issue is fixed in version 3.40.0, which addresses the vulnerability by properly validating and handling account IDs.

Defensive priority

High

Recommended defensive actions

• Review Budibase version and upgrade to 3.40.0 if necessary
• Verify email change workflows and authentication sessions
• Monitor for suspicious email change and password reset activities
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the Budibase email change vulnerability. The issue is fixed in version 3.40.0. Evidence from the CVE Program and NVD detail page confirms the vulnerability's existence and provides source-provided CVE metadata and source-specific vulnerability assessment. The CVE record was published on 2026-08-12T20:17:54.133Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.