EUVD-2026-57429
GHSA-cr7p-cr3q-h5cm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable unauthenticated endpoint justifies AV:N/PR:N; attacker-controlled 900-second account lockout constitutes A:L, which the vendor vector omits.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and Retry-After only for locked identifiers. An unauthenticated attacker could compare the response after repeated failures to enumerate valid email addresses and temporarily lock valid accounts. This issue is fixed in version 3.39.25.
AnalysisAI
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrepancy in the login lockout mechanism: the login endpoint returns distinct HTTP 403 headers (X-Account-Locked: 1, Retry-After: 900) for locked existing accounts but a generic 403 for non-existent addresses, allowing an unauthenticated remote attacker to verify whether any email is registered in a tenant. Beyond reconnaissance, an attacker can deliberately trigger 5 failed attempts against a known valid address to lock that account for 900 seconds. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; remediation via upgrade to 3.39.25 is straightforward.
Technical ContextAI
Budibase is an open-source low-code platform distributed as an npm package (@budibase/server). The flaw is rooted in CWE-204 (Observable Response Discrepancy): two cooperating files implement login lockout asymmetrically. In packages/worker/src/middleware/emailLockout.ts, the lockout middleware first queries the database for the submitted email and only checks the lockout cache when the user exists (dbUser && isLocked(email)), meaning non-existent addresses are never blocked regardless of attempt count. In packages/worker/src/api/controllers/global/auth.ts, the onFailed() counter - which increments the Redis/cache failure tally - is called only when dbUser is truthy. The combined effect: existing users accumulate failures and eventually trigger the distinctive lockout response; non-existent users never do, creating a binary oracle. The login route (POST /api/global/auth/:tenantId/login) carries no IP-based rate limiting per the advisory, and the route is registered without authentication middleware. CPE cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:* covers all affected versions below 3.39.25.
RemediationAI
Upgrade Budibase to version 3.39.25 or later, the vendor-confirmed fixed release documented at https://github.com/Budibase/budibase/releases/tag/3.39.25 and implemented via commit eaae816ab81615c07eb10e4619af078d00e2a706. The fix removes the dbUser guard from onFailed() so the failure counter increments uniformly for all submitted email addresses, and removes the user-existence database lookup from the lockout middleware so lock status is checked without leaking whether an account exists. If immediate upgrade is not possible, deploy a reverse proxy or WAF rule that enforces IP-based rate limiting on POST /api/global/auth/:tenantId/login - note this reduces enumeration speed but does not eliminate the response discrepancy. Operators should also alert on clusters of 403 responses to the login endpoint from a single source IP to detect active enumeration attempts.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaS
Unauthenticated account takeover of pending invited users in Budibase Server (@budibase/server) versions 3.41.0 through
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Same weakness CWE-204 – Observable Response Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today