CVE-2026-73406 in Budibase
Summary
by MITRE • 08/12/2026
Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier, distinguish existing users from missing users, and obtain tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata. This issue is fixed in version 3.39.32.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability affects Budibase's open-source low-code platform and represents a significant information disclosure flaw that undermines the platform's authentication and authorization mechanisms. The issue stems from improper endpoint configuration where the GET /api/global/users/tenant/:id endpoint was mistakenly included in the PUBLIC_ENDPOINTS array within the worker service's API routing configuration. This misconfiguration allowed any unauthenticated user to access sensitive user data through what should have been a protected internal endpoint.
The technical flaw manifests through the tenantUserLookup function which, when invoked through the exposed endpoint, returns complete PlatformUser documents containing extensive metadata about users within the system. This exposure enables attackers to perform user enumeration attacks by querying various email addresses or user identifiers and distinguishing between existing accounts and non-existent ones based on response differences. The vulnerability creates a clear attack surface that exposes tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata without any form of authentication or authorization checks.
From an operational impact perspective, this vulnerability allows threat actors to conduct reconnaissance activities against the platform's user base, potentially enabling more sophisticated attacks such as targeted credential stuffing, social engineering campaigns, or privilege escalation attempts. The exposure of tenant identifiers particularly concerning since they may reveal organizational structures and relationships between different user groups within the platform. This information disclosure aligns with CWE-200 (Information Exposure) and represents a violation of the principle of least privilege as defined in cybersecurity frameworks.
The attack pattern follows typical reconnaissance methodologies documented in MITRE ATT&CK framework under technique T1087 (Account Discovery) where adversaries seek to identify valid accounts and user permissions within target systems. The vulnerability's exploitation requires no authentication credentials and can be performed through simple HTTP GET requests, making it particularly dangerous for platforms handling sensitive organizational data. Organizations using affected versions of Budibase face increased risk of targeted attacks and potential data breaches.
The fix implemented in version 3.39.32 addresses this issue by removing the vulnerable endpoint from the PUBLIC_ENDPOINTS configuration and ensuring proper authentication requirements are enforced for user lookup operations. This remediation aligns with security best practices that require strict access controls and proper endpoint categorization to prevent information disclosure vulnerabilities. System administrators should immediately upgrade to version 3.39.32 or later and conduct thorough security assessments of their platform configurations to ensure no similar misconfigurations exist in other endpoints or services within their Budibase deployments.