PT-2026-30170 · Budibase · Budibase

Hasinohacker · Published 2026-04-03 · Updated 2026-04-03 · CVE-2026-25043

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.23.25

Description Budibase, an open-source low-code platform, contains a business logic issue in its password reset functionality. The “Forgot Password” endpoint lacks rate limiting, CAPTCHA, or abuse prevention mechanisms. An unauthenticated attacker can repeatedly trigger password reset requests for the same email address, leading to a large number of password reset emails being sent in a short period. This can result in email flooding, user harassment, and denial of service (DoS) against user inboxes, potentially causing financial and reputational damage.

Recommendations Update Budibase to version 3.23.25 or later.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-25043

Affected Products

Budibase

References · 4

• 🔥 https://github.com/Budibase/budibase/security/advisories/GHSA-277c-prw2-rqgh · Exploit
• https://github.com/Budibase/budibase/commit/21bc3f812b2312f082f7683c2abc22d1ecc880c7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25043 · Security Note
• https://twitter.com/CVEnew/status/2040111822620303698 · Twitter Post