Summary

PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) reassigns the email of the tenant account holder (the top-privilege admin), saving with isAccountHolder:true, allowChangingEmail:true (deliberately bypassing the normal "cannot change the account-holder" protection). The route's only authorization is the cloudRestricted middleware, which is a no-op when SELF_HOSTED / DISABLE_ACCOUNT_PORTAL is set; the router-wide guard then requires only that the caller is authenticated. So any logged-in user — including the lowest-privilege BASIC app user — can repoint the admin's email to an attacker address, then run the public password-reset flow to fully take over the admin account.

Details

• Route: packages/worker/src/api/routes/global/users.ts:80-84 — PUT /api/global/users/tenant/owner on the cloudRestrictedRoutes group.
• Group: packages/worker/src/api/routes/endpointGroups/standard.ts — cloudRestrictedRoutes = group(cloudRestricted) (no adminOnly/role check).
• packages/worker/src/middleware/cloudRestricted.ts:9-26 — the isValidInternalAPIKey check is wrapped in if (!env.SELF_HOSTED && !env.DISABLE_ACCOUNT_PORTAL); in self-host it falls straight through to next().
• Router guard packages/worker/src/api/index.ts (~line 160) requires only ctx.isAuthenticated && ctx.user.budibaseAccess (every global user, any role).
• Handler packages/worker/src/api/controllers/global/users.ts:109-141 — takes originalEmail, newAccountEmail, tenantIds from the request body; sets tenantUser.email = newAccountEmail, clears SSO, saves isAccountHolder:true, allowChangingEmail:true.

PoC

1. An admin/account-holder exists (admin@poc.local). Create + log in a normal BASIC user (basic@poc.local, verified builder.global=false, admin.global=false).
2. As the BASIC user:

curl -s -b basic.ck -X PUT localhost:10000/api/global/users/tenant/owner \
  -H 'Content-Type: application/json' \
  -d '{"originalEmail":"admin@poc.local","newAccountEmail":"attacker@evil.test","tenantIds":["default"]}'

Result

• Response: HTTP 200 OK.
• Admin email reassigned: login as admin@poc.local → 403; login as attacker@evil.test (now the admin account) → 200. This email-hijack primitive is what was demonstrated live — a BASIC user moved the top-privilege account-holder identity to an attacker-controlled address.
• Takeover completion (caveat — honesty): the next step is the standard public password-reset against attacker@evil.test. On the PoC instance this returned 400 because no SMTP was configured on the test box (reset cannot send the mail), so the reset→login leg was not executed end-to-end here. On any production self-host (SMTP configured — the normal state), the reset email lands in the attacker's mailbox → new password → full admin/account-holder takeover (global builder + admin → app source, all datasource credentials, all data, and builder-only server-side automation steps incl. the self-host bash/executeScript step = server RCE). The completion is a generic SMTP-gated consequence of owning the account email, not a separate vulnerability — but it is flagged here as not-live-reproduced rather than claimed.

Impact

Privilege escalation
Account take over
Admin account take over