CVE-2026-73303

creationtimestamp| type| source ---|---|--- 2026-08-12 21:01:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msvzmsvtfy2m 2026-08-14 02:20:06+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3msz3uquz5e23...

CVE-2026-73303

Budibase vulnerability CVE-2026-73303: An IDOR in the Email Change flow existed prior to 3.40.0 where POST /api/v2/email accepted a client-controlled accountId without binding it to the authenticated session, validating only currentEmail. An attacker who knew a victim’s accountId could initiate t...