Budibase information disclosure in tenant user lookup endpoint

Executive brief

Budibase, a platform for building internal business applications, contains a security flaw in its Worker service. An unauthenticated person can access a public web address to retrieve sensitive details about users, including their email addresses, internal IDs, and organizational identifiers. This information could be used to identify valid accounts and launch more targeted attacks against specific organizations using the platform.

Technical details

The Budibase Worker service exposes an unauthenticated API endpoint at `GET /api/global/users/tenant/:id` due to its inclusion in the `PUBLIC_ENDPOINTS` list. The `tenantUserLookup` controller fails to implement field filtering or authorization checks, returning the complete `PlatformUser` object from the database. An unauthenticated attacker can provide a user's email or ID to retrieve sensitive fields such as `tenantId`, `userId`, `ssoId`, and CouchDB revision tokens (`_rev`). Additionally, the endpoint returns different HTTP status codes (200 vs 400) based on user existence, facilitating mass user enumeration.

Affected products

• Budibase budibase <= 3.38.1

Timeline

• 2026-07-22: disclosed
• 2026-07-24: advisory

References

• https://api.github.com/users/sondt99
• https://github.com/sondt99
• https://api.github.com/users/sondt99/gists%7B/gist_id%7D
• https://api.github.com/users/sondt99/repos
• https://avatars.githubusercontent.com/u/87920408?v=4
• https://api.github.com/users/sondt99/events%7B/privacy%7D