# CVE-2026-73306: Budibase account enumeration via login lockout response differential

Source: https://junglewise.ai/threats/cve-2026-73306-budibase-account-enumeration-via-login-lockout-response  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73306 · Severity: low · CVSS 3.1 · Published 2026-07-24

Budibase is a low-code platform for building web applications. The login system leaks whether an email address is registered by returning different lockout responses for valid versus non-existent accounts after multiple failed login attempts. An attacker can rapidly enumerate valid user accounts and lock them out for 15 minutes, enabling targeted phishing or credential stuffing attacks.

Technologies: [@budibase/server (npm)](https://junglewise.ai/threats/technologies/budibase-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-73306 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73306 being exploited in the wild.

**How severe is CVE-2026-73306?** Low severity, with a CVSS score of 3.1, published 24 July 2026.

**Which products and versions are affected?** @budibase/server (npm) SEMVER:introduced=0,last_affected=3.38.1.

**Is there a fix for CVE-2026-73306?** A patch was published on 2026-07-22: Version 3.40.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73306 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73306?** Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an account enumeration vulnerability caused by inconsistent lockout behavior in the login middleware and authentication handler. When an existing user fails login 5 times, the server returns a 403 with X-Account-Locked: 1 and Retry-After headers plus "Account temporarily locked" message; for non-existent users, all responses are generic 403 "Unauthorized" because the failure counter is never incremented. The root cause is that lockout tracking is conditioned on user existence (dbUser check in packages/worker/src/middleware/lockout.ts and packages/worker/src/api/controllers/global/auth.ts), creating an observable timing/response discrepancy. The login endpoint has no IP-based rate limiting, allowing rapid enumeration from a single source (~5 requests per email). Attack requires only network access to the login endpoint and no authentication; each successful enumeration also triggers a 15-minute account lockout as a denial-of-service side effect. A patch is available in version 3.40.0 or later.

## Affected products

- Budibase Budibase <3.40.0

## Identifiers

- CVE-2026-73306
- GHSA-cr7p-cr3q-h5cm

## Timeline

- 2026-07-24: disclosed
- 2026-07-22: patched: Version 3.40.0

## References

- [https://github.com/Budibase/budibase/security/advisories/GHSA-cr7p-cr3q-h5cm](https://github.com/Budibase/budibase/security/advisories/GHSA-cr7p-cr3q-h5cm)
- [https://github.com/Budibase/budibase/pull/19108](https://github.com/Budibase/budibase/pull/19108)

## Related threats

- [Budibase S3 signed upload URL issuance via attachments endpoint](https://junglewise.ai/threats/cve-2026-54356-budibase-s3-signed-upload-url-issuance-via-attachments-endpoint)
- [Budibase automation SSRF in webhook and integration steps](https://junglewise.ai/threats/cve-2026-35219-budibase-automation-ssrf-in-webhook-and-integration-steps)
- [Budibase S3 presigned URL authorization regression](https://junglewise.ai/threats/cve-2026-72859-budibase-s3-presigned-url-authorization-regression)
- [Budibase MySQL DESCRIBE backtick injection via multipleStatements](https://junglewise.ai/threats/cve-2026-73408-budibase-mysql-describe-backtick-injection-via-multiplestatements)
- [Budibase privilege escalation in public role assignment API](https://junglewise.ai/threats/cve-2026-73305-budibase-privilege-escalation-in-public-role-assignment-api)