EUVD-2026-57433
GHSA-hr66-5mqr-8mpx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable public endpoint requiring no authentication (AV:N, AC:L, PR:N, UI:N); only confidentiality impacted as no data modification or service disruption is possible (I:N, A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier, distinguish existing users from missing users, and obtain tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata. This issue is fixed in version 3.39.32.
AnalysisAI
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email addresses, user IDs, SSO identifiers, and document revision metadata via a public API endpoint that was intentionally exempted from authentication middleware - accompanied by a TODO comment in source acknowledging it should have been restricted. Any network-reachable unauthenticated caller can query the Worker service endpoint GET /api/global/users/tenant/:id with an email or user identifier and receive a full PlatformUser document. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Budibase Worker service must be reachable over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects this vulnerability: network-accessible, no authentication, low complexity, and high confidentiality impact with no integrity or availability dimension. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a crafted `GET /api/global/users/tenant/target@example.com` request to a publicly accessible Budibase Worker service. The service bypasses all authentication and returns the full `PlatformUser` document containing the target's tenantId, userId, email, ssoId, and revision metadata. … |
| Remediation | The vendor-released patch is Budibase version 3.39.32, available at https://github.com/Budibase/budibase/releases/tag/3.39.32; administrators should upgrade immediately. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Budibase deployments to identify instances running versions prior to 3.39.32, determine which are Internet-accessible, and immediately implement firewall or WAF rules to restrict unauthenticated access to the GET /api/global/users/tenant/:id endpoint. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Authentication bypass in Budibase low-code platform (versions prior to 3.35.4) allows remote unauthenticated attackers t
Remote code execution in Budibase versions prior to 3.33.4 allows unauthenticated attackers to execute arbitrary Bash co
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today