Vulnerability · Published Aug 12, 2026 · Assigned by GitHub_M

CVE-2026-73306Budibase: Account Enumeration via Login Lockout Response Differential

Medium 5.3

In plain English

A medium-severity security flaw in budibase from Budibase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 61.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and Retry-After only for locked identifiers. An unauthenticated attacker could compare the response after repeated failures to enumerate valid email addresses and temporarily lock valid accounts. This issue is fixed in version 3.39.25.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@budibase/server	no fix listed	GHSA-cr7p-cr3q-h5cm

Affected products (as reported)

Vendor	Product	Versions
Budibase	budibase	< 3.39.25

Weakness: CWE-204 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/Budibase/budibase/security/advisories/GHSA-cr7p-cr3q-h5cm x_refsource_CONFIRM
https://github.com/Budibase/budibase/pull/19108 x_refsource_MISC
https://github.com/Budibase/budibase/commit/eaae816ab81615c07eb10e4619af078d00e2a706 x_refsource_MISC
https://github.com/Budibase/budibase/releases/tag/3.39.25 x_refsource_MISC