CVE-2026-73306 Budibase: Account Enumeration via Login Lockout Response Differential
An unauthenticated attacker can enumerate valid email addresses and lock accounts by analyzing login failure response differences in Budibase.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73306?
CVE-2026-73306 is a medium-severity vulnerability in budibase, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and Retry-After only for locked identifiers. An unauthenticated attacker could compare the response after repeated failures to enumerate valid email addresses and temporarily lock valid accounts. This issue is fixed in version 3.39.25.
Weakness: CWE-204
Which versions are affected by CVE-2026-73306?
2 open source packages ship an affected version, including @budibase/server.
| Package | Affected | Fixed in |
|---|---|---|
@budibase/server npm | All versions to 3.38.1 | None |
@budibase/server npm | All versions to 3.38.1 | None |
How do I fix CVE-2026-73306?
No fix has been published for CVE-2026-73306 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-73306 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73306 exists.
Sources
Also known as GHSA-cr7p-cr3q-h5cm.