P4Verified

CVE-2026-25043: budibase before 3.23.25 (exclusive), < 3.23.25

CVE-2026-25043. CVSS 3.1 base score 7.5 (HIGH, NVD). EPSS 0.00297 (percentile 0.20335), scored 2026-10-05.

Affected technology

budibase · before 3.23.25 (exclusive)
budibase

budibase · < 3.23.25
Budibase

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can repeatedly trigger password reset requests for the same email address, resulting in hundreds of password reset emails being sent in a short time window. Vendor/CNA’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality and integrity impact as none; availability impact as low. NVD’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high.

Published 2026-10-07 02:35:18.129075+00:00

CWE: CWE-770
CCR priority: 30.1 /100 (P4)
CVSS 3.1: 7.5 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · NVD
EPSS: 0.00297 · percentile 0.20335 · 2026-10-05
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-07 02:34:12.333111+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-25043.html