CVE-2026-73406
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Budibase prior to 3.39.32 exposes the GET /api/global/users/tenant/:id endpoint in PUBLIC_ENDPOINTS, and tenantUserLookup returns a full PlatformUser document. An unauthenticated caller could enumerate users and obtain tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata.
Risk Assessment
An unauthenticated attacker could enumerate users and obtain sensitive information, potentially facilitating further attacks such as phishing or account takeover.
Recommendation
Update Budibase to version 3.39.32 or later.
Original NVD description (English source)
Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier, distinguish existing users from missing users, and obtain tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata. This issue is fixed in version 3.39.32.