Business Logic Flaw in Budibase Password Reset Functionality

CVE-2026-25043

What is CVE-2026-25043?

Budibase, an open-source low-code platform, has a business logic vulnerability in its password reset functionality that could be exploited by unauthenticated attackers. In versions before 3.23.25, the 'Forgot Password' endpoint lacks adequate rate limiting, CAPTCHA, or other abuse prevention measures. This allows an attacker to repeatedly send password reset requests for the same email address, potentially flooding user inboxes with hundreds of reset emails in a short time, leading to user harassment and denial of service. This vulnerability has been addressed in the latest version, ensuring better protection against such exploitation.

References