CVE-2026-73306

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and Retry-After only for locked identifiers. An unauthenticated attacker could compare the response after repeated failures to enumerate valid email addresses and temporarily lock valid accounts. This issue is fixed in version 3.39.25.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Budibase/budibase/commit/eaae816ab81615c07eb10e4619af078d00e2a706
https://github.com/Budibase/budibase/pull/19108
https://github.com/Budibase/budibase/releases/tag/3.39.25
https://github.com/Budibase/budibase/security/advisories/GHSA-cr7p-cr3q-h5cm
https://github.com/Budibase/budibase/security/advisories/GHSA-cr7p-cr3q-h5cm

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-12 20:17

Updated : 2026-09-08 20:56

NVD link : CVE-2026-73306

Mitre link : CVE-2026-73306

CVE.ORG link : CVE-2026-73306

JSON object : View

Products Affected

No product.

CWE

CWE-204

Observable Response Discrepancy

{"id": "CVE-2026-73306", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73306", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T12:18:33.414991Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Budibase", "product": "budibase", "versions": [{"status": "affected", "version": "< 3.39.25"}]}]}], "published": "2026-08-12T20:17:54.270", "references": [{"url": "https://github.com/Budibase/budibase/commit/eaae816ab81615c07eb10e4619af078d00e2a706", "source": "security-advisories@github.com"}, {"url": "https://github.com/Budibase/budibase/pull/19108", "source": "security-advisories@github.com"}, {"url": "https://github.com/Budibase/budibase/releases/tag/3.39.25", "source": "security-advisories@github.com"}, {"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-cr7p-cr3q-h5cm", "source": "security-advisories@github.com"}, {"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-cr7p-cr3q-h5cm", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-204"}]}], "descriptions": [{"lang": "en", "value": "Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and Retry-After only for locked identifiers. An unauthenticated attacker could compare the response after repeated failures to enumerate valid email addresses and temporarily lock valid accounts. This issue is fixed in version 3.39.25."}], "lastModified": "2026-09-08T20:56:50.520", "sourceIdentifier": "security-advisories@github.com"}