CVE-2026-73306 Budibase CVE debrief

Who should care

Budibase administrators and users should assess their deployment exposure and verify configurations to prevent user enumeration and account lockout. Security teams and platform operators should review Budibase configurations and apply version 3.39.25 or later to protect against potential enumeration and lockout attacks. Vulnerability management and security teams should prioritize Budibase deployments for immediate review and mitigation.

Why it matters

CVE-2026-73306 allows for user enumeration and temporary account lockout in Budibase deployments. Budibase administrators should assess exposure, verify configurations, and apply version 3.39.25 or later.

• User enumeration is possible through repeated login attempts
• Valid accounts can be temporarily locked
• Configurations should be verified to prevent these issues
• Upgrade to version 3.39.25 or later to fix the issue

Technical summary

Budibase, an open-source low-code platform, had an issue where the failure counter for login attempts was only incremented for existing users. This allowed an unauthenticated attacker to enumerate valid email addresses by comparing responses after repeated failures. Additionally, valid accounts could be temporarily locked. The issue is fixed in version 3.39.25, which administrators should apply to prevent user enumeration and account lockout. Configurations should be verified to ensure the fix is effective and properly deployed.

Defensive priority

Assess Budibase deployment exposure, verify user enumeration and account lockout configurations, and apply version 3.39.25 or later.

Recommended defensive actions

• Assess Budibase deployment exposure
• Verify user enumeration and account lockout configurations
• Apply version 3.39.25 or later
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD entry provide details on the Budibase authentication issue, which allows for user enumeration and temporary account lockout. Evidence is limited to public CVE and NVD records. Defenders should verify Budibase deployment configurations and apply version 3.39.25 or later. Further details are not available from the CVE Program or NVD.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.