CVE-2026-25043

Budibase is an open-source low-code platform. Prior to version 3.23.25, a business logic vulnerability exists in Budibase’s password reset functionality due to the absence of rate limiting, CAPTCHA, or abuse prevention mechanisms on the “Forgot Password” endpoint. An unauthenticated attacker can repeatedly trigger password reset requests for the same email address, resulting in hundreds of password reset emails being sent in a short time window. This enables large-scale email flooding, user harassment, denial of service (DoS) against user inboxes, and potential financial and reputational impact for Budibase. This issue has been patched in version 3.23.25.

• CWE-770

• https://github.com/Budibase/budibase/commit/21bc3f812b2312f082f7683c2abc22d1ecc880c7Patch
• https://github.com/Budibase/budibase/security/advisories/GHSA-277c-prw2-rqghVendor Advisory
• https://github.com/Budibase/budibase/security/advisories/GHSA-277c-prw2-rqghVendor Advisory

Published

Apr 3, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25037An OS command injection vulnerability exists in XWEB Pro v…8.8
• CVE-2026-25038Gitea 1.26.2 allows unauthorized users to access labels of p…7.5
• CVE-2026-25039Parsec is a cloud-based application for simple and cryptogra…8.8
• CVE-2026-2504The Dealia – Request a quote plugin for WordPress is vulnera…4.3
• CVE-2026-25040Budibase is a low code platform for creating internal tools,…8.8
• CVE-2026-25041Budibase is a low code platform for creating internal tools,…7.2
• CVE-2026-25044Budibase is an open-source low-code platform. Prior to versi…8.8
• CVE-2026-25045Budibase is a low code platform for creating internal tools,…8.8
• CVE-2026-25046Kimi Agent SDK is a set of libraries that expose the Kimi Co…2.9
• CVE-2026-25047deepHas provides a test for the existence of a nested object…8.8
• CVE-2026-25048xgrammar is an open-source library for efficient, flexible, …7.5
• CVE-2026-25049n8n is an open source workflow automation platform. Prior to…9.9