Authentication Bypass in Budibase via Email Enumeration

Executive Summary

CVE-2026-73306 is an enumeration vulnerability in Budibase where unauthenticated attackers can determine valid email addresses by exploiting inconsistent lockout responses. The system only incremented failure counters and applied lockouts for existing users, while non-existent users received generic responses. This allowed attackers to send repeated login attempts and observe different responses to identify valid accounts.

Useful 0 Not Useful 0

Detection Guidance

Monitor login responses for differential behavior. Send repeated login attempts to test accounts and observe responses. Valid accounts may return 'Account temporarily locked' with headers 'X-Account-Locked: 1' and 'Retry-After: 900' after 5 failed attempts, while invalid accounts return generic 'Unauthorized' responses.

Useful 0 Not Useful 0

Impact Analysis

Attackers could enumerate valid user emails, temporarily lock accounts after 5 failed attempts, and perform denial-of-service by locking accounts for 15 minutes. Valid accounts may be inaccessible during lockout periods, and sensitive user data could be exposed through account identification.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR and HIPAA by enabling unauthorized access to user accounts and exposing personal data through email enumeration. It undermines data protection requirements for access controls and user privacy.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to Budibase version 3.39.25 or later. Implement IP-based rate limiting on the login endpoint to prevent rapid enumeration. Ensure lockout behavior applies uniformly to all email addresses regardless of user existence.

Useful 0 Not Useful 0