CVE-2026-25043: Budibase: Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email Flooding
Budibase is an open-source low-code platform. Prior to version 3.23.25, a business logic vulnerability exists in Budibase’s password reset functionality due to the absence of rate limiting, CAPTCHA, or abuse prevention mechanisms on the “Forgot Password” endpoint. An unauthenticated attacker can repeatedly trigger password reset requests for the same email address, resulting in hundreds of password reset emails being sent in a short time window. This enables large-scale email flooding, user harassment, denial of service (DoS) against user inboxes, and potential financial and reputational impact for Budibase. This issue has been patched in version 3.23.25.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.23.25
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25043?
CVE-2026-25043 is considered a business logic vulnerability that may lead to unauthorized use of the password reset functionality.
How do I fix CVE-2026-25043?
To fix CVE-2026-25043, upgrade to Budibase version 3.23.25 or later, where the vulnerability has been addressed.
What are the potential impacts of CVE-2026-25043?
The potential impacts of CVE-2026-25043 include email flooding attacks due to the lack of rate limiting on the password reset endpoint.
Who is affected by CVE-2026-25043?
Users of Budibase versions prior to 3.23.25 are affected by CVE-2026-25043.
Is there a known exploit for CVE-2026-25043?
While there is no specific exploit reported for CVE-2026-25043, the vulnerability's design could easily be exploited to flood email accounts.