CVE-2026-25043
Business Logic Flaw in Budibase Password Reset Enables Email Flooding
Publication date: 2026-04-03
Last updated on: 2026-04-21
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| budibase | budibase | to 3.23.25 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-25043 is a business logic vulnerability in Budibase's password reset functionality. The issue exists because the "Forgot Password" endpoint does not have protections like rate limiting, CAPTCHA, or abuse prevention mechanisms.
This allows an unauthenticated attacker to repeatedly trigger password reset requests for the same email address, causing hundreds or thousands of password reset emails to be sent in a short time.
The attack can be automated using common tools and requires no special privileges or user interaction.
How can this vulnerability impact me? :
This vulnerability can lead to large-scale email flooding, which may harass users by overwhelming their inboxes with password reset emails.
It can cause denial of service (DoS) against user inboxes, making it difficult or impossible for users to access legitimate emails.
For Budibase, it can result in significant financial costs due to the volume of emails sent via Amazon Simple Email Service (SES), as well as reputational damage.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring repeated password reset requests to the Budibase "Forgot Password" endpoint (https://account.budibase.app/auth/forgot) for the same email address or from the same IP address in a short time frame.
Detection can involve checking server logs or network traffic for an unusually high volume of POST requests to the password reset endpoint.
Common tools like Burp Suite Intruder or automated scripts can be used by attackers to exploit this, so similar automated or scripted requests may be visible in logs.
Suggested commands to detect such activity might include:
- Using grep or similar tools to filter web server logs for repeated password reset requests for the same email or IP, e.g.:
- grep 'POST /auth/forgot' /var/log/nginx/access.log | awk '{print $1, $7, $0}' | sort | uniq -c | sort -nr
- Using network monitoring tools to detect spikes in traffic to the password reset endpoint.
- Checking for HTTP 429 (Too Many Requests) responses which indicate rate limiting is being triggered (if patched).
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Budibase to version 3.23.25 or later, where the vulnerability has been patched.
The patch introduces rate limiting on the password reset endpoint by email and IP address, rejecting excessive requests with HTTP 429 responses.
Additional mitigations include enabling CAPTCHA or other abuse prevention mechanisms on the password reset functionality to prevent automated abuse.
If upgrading immediately is not possible, monitoring and manually blocking IPs or throttling requests to the password reset endpoint can help reduce abuse.
Implementing email normalization and account lockout mechanisms for failed login attempts also helps reduce brute-force and abuse risks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Budibase's password reset functionality allows unauthenticated attackers to trigger large volumes of password reset emails, resulting in email flooding, user harassment, and denial of service against user inboxes.
While the CVE description and resources do not explicitly mention compliance with standards such as GDPR or HIPAA, the potential for denial of service and user harassment could indirectly impact compliance by affecting user data availability and user trust.
Additionally, the financial and reputational damage caused by abuse of the email system could affect the organization's ability to maintain compliance with regulations that require safeguarding user data and ensuring service availability.
However, there is no direct information provided about specific compliance violations or regulatory impacts caused by this vulnerability.