CVE-2026-25043

Description

Budibase is an open-source low-code platform. Prior to version 3.23.25, a business logic vulnerability exists in Budibase-s password reset functionality due to the absence of rate limiting, CAPTCHA, or abuse prevention mechanisms on the -Forgot Password- endpoint. An unauthenticated attacker can repeatedly trigger password reset requests for the same email address, resulting in hundreds of password reset emails being sent in a short time window. This enables large-scale email flooding, user harassment, denial of service (DoS) against user inboxes, and potential financial and reputational impact for Budibase. This issue has been patched in version 3.23.25.