Executive brief
Budibase, a platform for building business applications, contains a flaw in its login security mechanism. An attacker can determine if specific email addresses are registered on the system by observing how the server responds to repeated failed login attempts. This could lead to the exposure of user lists, targeted phishing attacks, and temporary account lockouts for legitimate users.
Technical details
The vulnerability is a result of an observable response discrepancy (CWE-204) in the login lockout implementation. The lockout middleware and login handler only increment failure counters and return lockout-specific headers (X-Account-Locked and Retry-After) for users that exist in the database. For non-existent users, the system consistently returns a generic 403 Unauthorized response regardless of the number of attempts. An unauthenticated attacker can exploit this by sending 5-6 login requests per email address to identify valid accounts. Additionally, the lack of IP-based rate limiting on the login endpoint facilitates high-speed enumeration. The issue is addressed in version 3.40.0.
Affected products
- Budibase Budibase < 3.40.0
Timeline
- 2026-07-22: disclosed
- 2026-07-24: advisory
- 2026-07-24: patched
References
- https://github.com/Budibase/budibase/security/advisories/GHSA-cr7p-cr3q-h5cm
- https://github.com/Budibase/budibase/pull/19108
- https://github.com/Budibase/budibase/commit/eaae816ab81615c07eb10e4619af078d00e2a706
- https://github.com/Budibase/budibase/releases/tag/3.39.25
- https://api.github.com/repos/Budibase/budibase/security-advisories/GHSA-cr7p-cr3q-h5cm