CVE-2026-25043 Budibase CVE debrief

Who should care

Budibase users and administrators, operators of Budibase deployments, platform security teams, and vulnerability management teams should be aware of this vulnerability and take steps to mitigate it by updating to version 3.23.25 or later.

Technical summary

The vulnerability exists in the 'Forgot Password' endpoint of Budibase, where an unauthenticated attacker can repeatedly trigger password reset requests for the same email address. This is due to the absence of rate limiting, CAPTCHA, or abuse prevention mechanisms. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. Affected Budibase deployments prior to version 3.23.25 should be identified and patched. Technical impact includes potential for large-scale email flooding and user harassment.

Defensive priority

Medium priority should be given to patching this vulnerability, as it can lead to email flooding and user harassment.

Recommended defensive actions

• Update Budibase to version 3.23.25 or later
• Implement rate limiting and CAPTCHA on the 'Forgot Password' endpoint
• Monitor for potential email flooding and harassment attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-03T16:16:35.607Z and was last modified on 2026-07-24T22:10:00.140Z. The NVD entry is currently Analyzed. Budibase users should verify their deployment against the official advisory for accurate affected versions and configurations. Evidence is based on public CVE and NVD data, which may have limitations in scope and detail.

Official resources