EUVD-2026-57433
GHSA-hr66-5mqr-8mpx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable public endpoint requiring no authentication (AV:N, AC:L, PR:N, UI:N); only confidentiality impacted as no data modification or service disruption is possible (I:N, A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier, distinguish existing users from missing users, and obtain tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata. This issue is fixed in version 3.39.32.
AnalysisAI
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email addresses, user IDs, SSO identifiers, and document revision metadata via a public API endpoint that was intentionally exempted from authentication middleware - accompanied by a TODO comment in source acknowledging it should have been restricted. Any network-reachable unauthenticated caller can query the Worker service endpoint GET /api/global/users/tenant/:id with an email or user identifier and receive a full PlatformUser document. No public exploit code has been identified at time of analysis, though the attack is trivially reproducible from the public GitHub security advisory alone.
Technical ContextAI
Budibase is a multi-tenant, open-source low-code application platform implemented in TypeScript/Node.js, with a Worker service handling global user management. The root cause (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) is a misconfigured access control list: the route GET /api/global/users/tenant/:id was placed in the PUBLIC_ENDPOINTS array at packages/worker/src/api/index.ts lines 56-59. This array is passed to auth.buildAuthMiddleware(), which sets ctx.publicEndpoint = true on matching requests and calls next() without performing any authentication check. All downstream middleware - buildTenancyMiddleware, activeTenant, buildCsrfMiddleware, and the budibaseAccess gate - similarly bypass processing when ctx.publicEndpoint is true. The handler tenantUserLookup accepts either an email (detected by @) or a user ID as the :id path parameter and returns the full PlatformUser document without field filtering. A 200 vs. 400 response differential also enables user enumeration. Affected product is identified by CPE cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:* for all versions prior to 3.39.32.
RemediationAI
The vendor-released patch is Budibase version 3.39.32, available at https://github.com/Budibase/budibase/releases/tag/3.39.32; administrators should upgrade immediately. The fix removes the GET /api/global/users/tenant/:id route from PUBLIC_ENDPOINTS and reassigns it to internalRoutes, which requires internal API authentication headers and returns HTTP 403 to unauthenticated callers - confirmed by the updated test suite in PR #19221. The fix commit is 0bdf648ff4c024a138a546ef84217e4efbee538e. No documented vendor workaround exists short of upgrading; however, as a compensating control for operators unable to patch immediately, blocking or rate-limiting requests to the path /api/global/users/tenant/ at the reverse proxy or WAF layer will prevent external exploitation. This compensating control may break legitimate internal service integrations that rely on this endpoint for user lookup and should be treated as temporary. Self-hosted deployments where the Worker service is not internet-exposed have substantially reduced risk.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaS
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Unauthenticated account takeover of pending invited users in Budibase Server (@budibase/server) versions 3.41.0 through
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today