GHSA-c8vc-7pv3-g98p: Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)

POST /api/v2/email on the account portal (account.budibase.app) starts an email-change workflow using a client-supplied accountId that is not validated against the authenticated session. A logged-in attacker supplies a victim’s accountId and an email address they control; the verification code is delivered to the attacker’s address, and completing the workflow changes the victim’s account email. The attacker then password-resets the victim’s account through the controlled address and logs in — full account takeover with no victim interaction.