What is the CVSS score of EUVD-2026-57433?

EUVD-2026-57433 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Budibase are affected by EUVD-2026-57433?

Budibase installations (versions prior to 3.39.32) expose an unauthenticated information disclosure vulnerability allowing attackers to enumerate users and extract email addresses, user identifiers,…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-57433?

Yes, a public proof-of-concept exploit is available for EUVD-2026-57433. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate EUVD-2026-57433?

Within 24 hours, inventory all Budibase deployments to identify instances running versions prior to 3.39.32, determine which are Internet-accessible, and immediately implement firewall or WAF rules to restrict unauthenticated access to the GET `/api/global/users/tenant/:id` endpoint. Within 7 days, contact Budibase support to confirm patch status and anticipated timeline, review API access logs for indicators of exploitation (repeated enumeration queries to the endpoint), and document which user information may have been exposed. Within 30 days, deploy the vendor-released patch to all affected instances as soon as it becomes available, verify the endpoint now properly enforces authentication, and initiate notification procedures for any confirmed user exposure.

Budibase EUVD-2026-57433

| CVE-2026-73406 HIGH

Information Exposure (CWE-200)

2026-08-12 GitHub_M

GHSA-hr66-5mqr-8mpx

Information Disclosure Budibase

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable public endpoint requiring no authentication (AV:N, AC:L, PR:N, UI:N); only confidentiality impacted as no data modification or service disruption is possible (I:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 12, 2026 - 20:03 EUVD

Source Code Evidence Fetched

Aug 12, 2026 - 19:47 vuln.today

Analysis Generated

Aug 12, 2026 - 19:47 vuln.today

CVE Published

Aug 12, 2026 - 19:03 cve.org

HIGH 7.5

DescriptionCVE.org

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier, distinguish existing users from missing users, and obtain tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata. This issue is fixed in version 3.39.32.

AnalysisAI

Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email addresses, user IDs, SSO identifiers, and document revision metadata via a public API endpoint that was intentionally exempted from authentication middleware - accompanied by a TODO comment in source acknowledging it should have been restricted. Any network-reachable unauthenticated caller can query the Worker service endpoint GET /api/global/users/tenant/:id with an email or user identifier and receive a full PlatformUser document. No public exploit code has been identified at time of analysis, though the attack is trivially reproducible from the public GitHub security advisory alone.

Technical ContextAI

Budibase is a multi-tenant, open-source low-code application platform implemented in TypeScript/Node.js, with a Worker service handling global user management. The root cause (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) is a misconfigured access control list: the route GET /api/global/users/tenant/:id was placed in the PUBLIC_ENDPOINTS array at packages/worker/src/api/index.ts lines 56-59. This array is passed to auth.buildAuthMiddleware(), which sets ctx.publicEndpoint = true on matching requests and calls next() without performing any authentication check. All downstream middleware - buildTenancyMiddleware, activeTenant, buildCsrfMiddleware, and the budibaseAccess gate - similarly bypass processing when ctx.publicEndpoint is true. The handler tenantUserLookup accepts either an email (detected by @) or a user ID as the :id path parameter and returns the full PlatformUser document without field filtering. A 200 vs. 400 response differential also enables user enumeration. Affected product is identified by CPE cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:* for all versions prior to 3.39.32.

RemediationAI

The vendor-released patch is Budibase version 3.39.32, available at https://github.com/Budibase/budibase/releases/tag/3.39.32; administrators should upgrade immediately. The fix removes the GET /api/global/users/tenant/:id route from PUBLIC_ENDPOINTS and reassigns it to internalRoutes, which requires internal API authentication headers and returns HTTP 403 to unauthenticated callers - confirmed by the updated test suite in PR #19221. The fix commit is 0bdf648ff4c024a138a546ef84217e4efbee538e. No documented vendor workaround exists short of upgrading; however, as a compensating control for operators unable to patch immediately, blocking or rate-limiting requests to the path /api/global/users/tenant/ at the reverse proxy or WAF layer will prevent external exploitation. This compensating control may break legitimate internal service integrations that rely on this endpoint for user lookup and should be treated as temporary. Self-hosted deployments where the Worker service is not internet-exposed have substantially reduced risk.