CVE-2026-25043: Budibase Password Reset DoS Vulnerability

CVE-2026-25043 Overview

CVE-2026-25043 is a business logic vulnerability affecting Budibase, an open-source low-code platform. The vulnerability exists in the password reset functionality due to the absence of rate limiting, CAPTCHA, or abuse prevention mechanisms on the "Forgot Password" endpoint. An unauthenticated attacker can repeatedly trigger password reset requests for the same email address, resulting in hundreds of password reset emails being sent in a short time window.

This business logic flaw enables large-scale email flooding, user harassment, denial of service (DoS) against user inboxes, and potential financial and reputational impact for organizations using Budibase. The vulnerability was identified as CWE-770 (Allocation of Resources Without Limits or Throttling).

Critical Impact

Unauthenticated attackers can abuse the password reset endpoint to flood user inboxes with reset emails, causing denial of service and potential reputational damage to Budibase deployments.

Affected Products

• Budibase versions prior to 3.23.25
• Self-hosted Budibase installations with exposed password reset endpoints
• Cloud-hosted Budibase instances running vulnerable versions

Discovery Timeline

• 2026-04-03 - CVE-2026-25043 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-25043

Vulnerability Analysis

This vulnerability represents a classic business logic flaw where the application fails to implement proper resource allocation controls on a sensitive endpoint. The "Forgot Password" functionality lacks essential abuse prevention mechanisms that would normally limit the rate at which password reset requests can be submitted.

Without rate limiting or CAPTCHA verification, the endpoint becomes susceptible to automated abuse. An attacker can craft simple scripts to repeatedly call the password reset endpoint with a target email address, generating a flood of legitimate password reset emails. This attack requires no authentication and can be executed from any network location.

The impact extends beyond simple annoyance—mass email generation can trigger email service provider rate limits, potentially blocking legitimate organizational communications. Additionally, excessive email traffic may result in increased operational costs for organizations using metered email services.

Root Cause

The root cause of CVE-2026-25043 is the absence of request throttling mechanisms on the password reset endpoint. The application processes each password reset request independently without tracking request frequency per email address or IP address. This lack of resource allocation controls (CWE-770) allows unlimited requests to be processed, directly translating to unlimited email generation.

Properly secured password reset implementations typically include:

• Per-IP rate limiting
• Per-email address request throttling
• CAPTCHA challenges after initial requests
• Exponential backoff for repeated requests

The vulnerable Budibase versions implemented none of these protective measures, leaving the endpoint fully exposed to abuse.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending HTTP requests to the "Forgot Password" endpoint in rapid succession. The attack can be automated using basic scripting tools or HTTP clients.

The exploitation process involves identifying the password reset endpoint, crafting valid requests containing a target email address, and submitting requests at high volume. Each successful request triggers a legitimate password reset email to the target address, effectively weaponizing the application's own email infrastructure against its users.

Since no verification or throttling exists, an attacker can sustain this attack indefinitely, limited only by network bandwidth and the target server's capacity to process requests.

Detection Methods for CVE-2026-25043

Indicators of Compromise

• Unusually high volume of password reset emails sent to single email addresses
• Spike in outbound email traffic from Budibase application servers
• Multiple password reset requests from single IP addresses in short time windows
• User complaints about email flooding or inbox denial of service
• Email service provider warnings about sending limits or reputation issues

Detection Strategies

• Monitor application logs for repeated calls to the password reset endpoint with identical email parameters
• Implement network-level monitoring for high-frequency POST requests to authentication-related endpoints
• Configure email service alerts for unusual outbound volume patterns
• Review web application firewall (WAF) logs for automated request patterns targeting reset endpoints
• Analyze request timing patterns to identify scripted or automated abuse attempts

Monitoring Recommendations

• Deploy application-layer logging that captures timestamp, IP address, and email parameter for all password reset requests
• Configure SIEM rules to alert on password reset request rates exceeding normal thresholds
• Implement real-time monitoring of outbound email queues for abnormal volume spikes
• Establish baseline metrics for password reset request frequency to enable anomaly detection

How to Mitigate CVE-2026-25043

Immediate Actions Required

• Upgrade Budibase to version 3.23.25 or later immediately
• Review email logs for evidence of prior exploitation or abuse
• Consider temporarily disabling the password reset functionality if immediate patching is not possible
• Implement network-level rate limiting via WAF or reverse proxy as interim protection
• Notify affected users if email flooding has already occurred

Patch Information

Budibase has addressed this vulnerability in version 3.23.25. The fix implements proper rate limiting and abuse prevention mechanisms on the password reset endpoint. Organizations should upgrade to this version or later to remediate the vulnerability.

The security patch is available via the GitHub commit. Additional details can be found in the GitHub Security Advisory GHSA-277c-prw2-rqgh.

Workarounds

• Implement rate limiting at the web server or reverse proxy level (e.g., NGINX limit_req_zone) to throttle requests to the password reset endpoint
• Deploy a Web Application Firewall (WAF) rule to limit POST requests to authentication endpoints by IP address
• Consider implementing CAPTCHA protection via a reverse proxy or edge service if application-level patching is delayed
• Temporarily restrict access to the password reset endpoint to internal networks only if external access is not required
• Monitor and block IP addresses exhibiting abusive request patterns

# NGINX rate limiting configuration example
# Add to http context in nginx.conf
limit_req_zone $binary_remote_addr zone=password_reset:10m rate=5r/m;

# Add to location block for password reset endpoint
location /api/global/auth/password/reset {
    limit_req zone=password_reset burst=2 nodelay;
    proxy_pass http://budibase_backend;
}