The vulnerability in Budibase server arises from the login lockout feature that behaves differently for existing and non-existing users. Specifically, after 5 failed login attempts, existing users' accounts are locked and the server responds with a 403 status including 'X-Account-Locked: 1' and 'Retry-After: 900' headers plus a message indicating temporary lockout. For non-existing users, the server always returns a generic 403 Unauthorized response without incrementing any lockout counter. This discrepancy allows unauthenticated attackers to enumerate valid email addresses by observing the response differences. Additionally, the login endpoint does not implement IP-based rate limiting, enabling high-speed enumeration from a single IP. The lockout mechanism only applies to existing users, causing denial of service by locking out legitimate accounts for 15 minutes. The recommended fix is to unify lockout behavior regardless of user existence by tracking lockout state based on the email string alone.

An unauthenticated attacker can enumerate valid email addresses registered on a Budibase tenant by sending multiple login attempts and observing the distinct lockout response for existing users. The absence of IP-based rate limiting on the login endpoint allows rapid enumeration from a single IP address. Legitimate users with enumerated emails can be locked out for 15 minutes, causing denial of service. Confirmed valid emails can be leveraged for targeted phishing, credential stuffing, or social engineering attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The recommended fix is to modify the lockout mechanism to apply equally to all login attempts regardless of user existence, tracking lockout state based on the email string rather than database user presence. Implementing IP-based rate limiting on the login endpoint would also mitigate rapid enumeration. Until a fix is available, consider monitoring for unusual login attempts and applying external rate limiting or WAF rules to reduce enumeration risk.