Description

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and Retry-After only for locked identifiers. An unauthenticated attacker could compare the response after repeated failures to enumerate valid email addresses and temporarily lock valid accounts. This issue is fixed in version 3.39.25.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-12T20:17:54.270Z",
  "pubdate": "2026-08-12T20:17:54.270Z",
  "executiveSummary": "An email address enumeration and account lockout vulnerability exists in the Budibase open-source low-code platform prior to version 3.39.25.\nThe vulnerability allows unauthenticated remote attackers to determine the existence of valid user accounts within the system and temporarily lock legitimate users out of the application.\nThe flaw affects the global authentication endpoint located at POST /api/global/auth/:tenantId/login, impacting all Budibase deployments running versions prior to 3.39.25.\nThe risk implications include unauthorized information disclosure regarding valid system identifiers and potential denial of service via targeted account lockouts.\nExploitation requires network access to the target Budibase instance and does not require authentication or prior privileges, relying solely on sending repeated login requests and observing differential server responses.\nThe vulnerability is resolved by updating Budibase to version 3.39.25 or later, which addresses the discrepancy in failure tracking and lockout behavior.",
  "technicalDetails": "The vulnerability stems from inconsistent state tracking and error handling during the login process implemented in packages/worker/src/api/controllers/global/auth.ts and packages/worker/src/middleware/emailLockout.ts.\nSpecifically, the POST /api/global/auth/:tenantId/login endpoint only increments the internal authentication failure counter when an attack targets an existing user identifier.\nConcurrently, the emailLockout.ts middleware evaluates identifier lockout states, returning specific HTTP headers such as X-Account-Locked and Retry-After strictly for locked identifiers.\nAn unauthenticated attacker can leverage this architectural discrepancy via a network-based attack vector by submitting repeated authentication requests with arbitrary or sequential email addresses.\nBy analyzing the differential response patterns, status codes, and security headers returned by the server after multiple failed attempts, the attacker can infer whether a specific email address is registered within the tenant.\nFurthermore, by exhausting the allowable failure threshold for a valid email address, the attacker can trigger the lockout mechanism, causing the middleware to temporarily restrict access for the legitimate user.\nThe affected component involves global authentication controller logic and email lockout middleware within the worker package of Budibase.\nNo authentication or privileges are required to initiate this attack, making it accessible to any external entity with network reachability to the exposed login endpoint."
}