Description

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier, distinguish existing users from missing users, and obtain tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata. This issue is fixed in version 3.39.32.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-12T20:17:55.617Z",
  "pubdate": "2026-08-12T20:17:55.617Z",
  "executiveSummary": "An unauthenticated information disclosure vulnerability exists in Budibase prior to version 3.39.32. The flaw resides in the handling of user lookup requests within the API infrastructure, specifically exposing sensitive user data without requiring authentication or authorization checks. The impacted system is the Budibase low-code platform, which exposes the endpoint GET /api/global/users/tenant/:id as a publicly accessible route via PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts.\nThe risk implications are significant, as unauthorized external actors can harvest internal platform metadata, facilitating target profiling and reconnaissance. Attacker capabilities include querying email addresses or user identifiers to enumerate valid accounts, differentiate between existing and missing users, and extract sensitive attributes such as tenant identifiers, user identifiers, email addresses, single sign-on (SSO) identifiers, and underlying document revision metadata. Exploitation requires network access to the target Budibase instance and involves sending crafted HTTP GET requests to the vulnerable API endpoint without supplying valid session credentials.",
  "technicalDetails": "The root cause of the vulnerability stems from improper access control configuration within the API routing logic of Budibase. Specifically, the GET /api/global/users/tenant/:id endpoint was incorrectly categorized under PUBLIC_ENDPOINTS within packages/worker/src/api/index.ts. Because of this misclassification, the underlying request handler, tenantUserLookup, processes incoming requests without enforcing authentication or session validation checks.\nWhen an unauthenticated caller sends an HTTP GET request to the vulnerable endpoint containing an email address or user identifier, the server executes the tenantUserLookup function and returns a full PlatformUser document. This payload behavior bypasses security boundaries, leaking comprehensive user profiles and internal database identifiers directly to the public-facing network interface.\nThe attack flow proceeds as follows: 1. The unauthenticated attacker identifies a target Budibase deployment and targets the exposed route at GET /api/global/users/tenant/:id. 2. The attacker crafts an HTTP GET request supplying specific query parameters or path variables representing target email addresses or user identifiers. 3. The request reaches the Budibase worker component, bypassing authentication filters due to the public endpoint whitelist configuration. 4. The tenantUserLookup function queries the underlying data store and serializes the complete PlatformUser document. 5. The server responds with an HTTP status code and a JSON payload containing tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata. 6. The attacker parses the response to distinguish valid users from invalid ones and harvests the exposed metadata for subsequent attacks.\nThe affected versions include all Budibase deployments prior to version 3.39.32. The vulnerability requires zero privileges, no authentication credentials, and network exposure to the HTTP API. The post-exploitation impact includes unauthorized information leakage, user enumeration, and the exposure of internal system architecture identifiers that can be leveraged for further adversarial exploitation."
}