EUVD-2026-57429
GHSA-cr7p-cr3q-h5cm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable unauthenticated endpoint justifies AV:N/PR:N; attacker-controlled 900-second account lockout constitutes A:L, which the vendor vector omits.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and Retry-After only for locked identifiers. An unauthenticated attacker could compare the response after repeated failures to enumerate valid email addresses and temporarily lock valid accounts. This issue is fixed in version 3.39.25.
AnalysisAI
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrepancy in the login lockout mechanism: the login endpoint returns distinct HTTP 403 headers (X-Account-Locked: 1, Retry-After: 900) for locked existing accounts but a generic 403 for non-existent addresses, allowing an unauthenticated remote attacker to verify whether any email is registered in a tenant. Beyond reconnaissance, an attacker can deliberately trigger 5 failed attempts against a known valid address to lock that account for 900 seconds. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Unauthenticated HTTP(S) network access to POST /api/global/auth/:tenantId/login is the sole requirement; the route carries no authentication middleware per the advisory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) captures the enumeration impact but assigns A:N despite the advisory explicitly describing account lockout as an attacker capability - a secondary availability effect that is real but temporary (900-second lock). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with HTTP access to a Budibase instance iterates a list of candidate email addresses, sending 5 POST requests to /api/global/auth/:tenantId/login for each. Any address that returns a 403 with X-Account-Locked: 1 and Retry-After: 900 is confirmed as a registered account in that tenant; addresses returning only a generic 403 body are non-existent. … |
| Remediation | Upgrade Budibase to version 3.39.25 or later, the vendor-confirmed fixed release documented at https://github.com/Budibase/budibase/releases/tag/3.39.25 and implemented via commit eaae816ab81615c07eb10e4619af078d00e2a706. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Authentication bypass in Budibase low-code platform (versions prior to 3.35.4) allows remote unauthenticated attackers t
Remote code execution in Budibase versions prior to 3.33.4 allows unauthenticated attackers to execute arbitrary Bash co
Same weakness CWE-204 – Observable Response Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today