EUVD-2026-18752Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
7DescriptionNVD
Budibase is an open-source low-code platform. Prior to version 3.23.25, a business logic vulnerability exists in Budibase’s password reset functionality due to the absence of rate limiting, CAPTCHA, or abuse prevention mechanisms on the “Forgot Password” endpoint. An unauthenticated attacker can repeatedly trigger password reset requests for the same email address, resulting in hundreds of password reset emails being sent in a short time window. This enables large-scale email flooding, user harassment, denial of service (DoS) against user inboxes, and potential financial and reputational impact for Budibase. This issue has been patched in version 3.23.25.
AnalysisAI
Email flooding denial of service in Budibase prior to version 3.23.25 allows unauthenticated remote attackers to overwhelm user inboxes by repeatedly triggering password reset requests without rate limiting, CAPTCHA, or abuse prevention controls. An attacker can send hundreds of password reset emails to a target address in a short time window, causing user harassment, inbox denial of service, and potential reputational damage. This vulnerability has been patched in version 3.23.25.
Technical ContextAI
The vulnerability stems from a business logic flaw (CWE-770: Allocation of Resources Without Limits or Throttling) in Budibase's password reset endpoint. The 'Forgot Password' functionality lacks fundamental abuse prevention mechanisms such as rate limiting per email address, CAPTCHA verification, or request throttling. Budibase is an open-source low-code platform built for rapid application development; the vulnerable endpoint is exposed over the network (AV:N) and requires no authentication (PR:N), making it easily accessible. The absence of these controls violates secure development practices for user-facing authentication flows and enables attackers to rapidly generate outbound email traffic without computational or logical barriers.
RemediationAI
Upgrade Budibase to version 3.23.25 or later immediately. This patched release includes rate limiting, CAPTCHA, or other abuse prevention controls on the password reset endpoint. For organizations unable to upgrade immediately, implement network-level rate limiting rules on the 'Forgot Password' endpoint (e.g., via WAF or reverse proxy) to throttle requests from a single IP address or email address. Refer to the vendor's official advisory and the patched commit at https://github.com/Budibase/budibase/commit/21bc3f812b2312f082f7683c2abc22d1ecc880c7 for implementation details. Monitor email delivery logs for unusual password reset request volumes as a detection control.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Authentication bypass in Budibase low-code platform (versions prior to 3.35.4) allows remote unauthenticated attackers t
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today