CVE-2026-73306: Budibase: Account Enumeration via Login Lockout Response Differential
Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and Retry-After only for locked identifiers. An unauthenticated attacker could compare the response after repeated failures to enumerate valid email addresses and temporarily lock valid accounts. This issue is fixed in version 3.39.25.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.39.25
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73306?
CVE-2026-73306 has a medium severity rating of 5.3.
What is the risk associated with CVE-2026-73306?
CVE-2026-73306 carries a risk score of 27.
How do I fix CVE-2026-73306?
To fix CVE-2026-73306, update Budibase to version 3.39.25 or later.
What type of vulnerability is CVE-2026-73306?
CVE-2026-73306 is an account enumeration vulnerability via login lockout response differential.
What is affected by CVE-2026-73306?
CVE-2026-73306 affects Budibase, an open-source low-code platform prior to version 3.39.25.