CVE-2026-73306

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.25

Description An unauthenticated attacker can enumerate valid email addresses and temporarily lock valid accounts. This occurs because the failure counter in packages/worker/src/api/controllers/global/auth.ts is only incremented for existing users during requests to the '/api/global/auth/:tenantId/login' endpoint, while the packages/worker/src/middleware/emailLockout.ts middleware returns X-Account-Locked and Retry-After headers only for locked identifiers. By comparing these responses after repeated failed attempts, an attacker can distinguish between valid and invalid accounts.

Recommendations Update to version 3.39.25.