The vulnerability allows an unauthenticated attacker to determine whether an email address is associated with a Budibase account by observing differences in the lockout response when attempting to log in. The backend increases the failure counter only for existing users, while the lockout middleware returns distinct headers for locked identifiers. By repeatedly failing logins and comparing response headers, an attacker can enumerate valid emails and temporarily lock those accounts. This leads to information disclosure (account enumeration) and potential denial of service against account access.

Budibase open‑source platform, versions prior to 3.39.25. All deployments of Budibase 3.39.24 or earlier are affected because the login failure counter logic resides in packages/worker/src/api/controllers/global/auth.ts and the lockout middleware in packages/worker/src/middleware/emailLockout.ts.

With a CVSS score of 5.3 the vulnerability is considered moderate, and no EPSS data is available. It is not listed in CISA KEV. The attack can be carried out remotely over HTTP by sending repeated POST /api/global/auth/:tenantId/login requests; no authentication is required. An attacker who can perform these requests, for example by scanning the exposed API or using a web application scanner, can enumerate users and cause temporary lockouts, which may be used as part of a broader account‑takeover strategy.