CVE-2026-25043Medium· 5.3▾ SunlitBudibase is an open-source low-code platform. Prior to version 3.23.25, a business logic vulnerability exists in Budibase’s password reset functionality due to the absence of rate limiting, CAPTCHA, or abuse prevention mechanisms on the …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.3%
Budibase is an open-source low-code platform. Prior to version 3.23.25, a business logic vulnerability exists in Budibase’s password reset functionality due to the absence of rate limiting, CAPTCHA, or abuse prevention mechanisms on the “Forgot Password” endpoint. An unauthenticated attacker can repeatedly trigger password reset requests for the same email address, resulting in hundreds of password reset emails being sent in a short time window. This enables large-scale email flooding, user harassment, denial of service (DoS) against user inboxes, and potential financial and reputational impact for Budibase. This issue has been patched in version 3.23.25.
budibase < 3.23.25Upgrade past the affected range:
budibase 3.23.25Connected by shared product, vendor, weakness, or advisory.
CVE-2026-33226High· 8.7Budibase is a low code platform for creating internal tools, workflows, and admin panels
CVE-2026-35214High· 8.7Budibase is an open-source low-code platform
CVE-2026-35216Critical· 9.0Budibase is an open-source low-code platform
CVE-2026-103757High· 7.7Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist
CVE-2026-31818Critical· 9.6Budibase is an open-source low-code platform
CVE-2026-25044High· 8.8Budibase is an open-source low-code platform