Executive brief
Budibase is an open-source low-code platform used to build business applications. The Worker service exposes a public API endpoint that allows anyone, without authentication, to look up and retrieve sensitive user information such as email addresses, user IDs, tenant IDs, and SSO identifiers. This enables attackers to enumerate users in multi-tenant deployments and gather intelligence for targeted attacks against organizations using Budibase.
Technical details
The vulnerability is an information disclosure flaw in the GET /api/global/users/tenant/:id endpoint, which is registered in the PUBLIC_ENDPOINTS list despite containing a TODO comment stating it "should be an internal api." The endpoint bypasses all authentication and authorization middleware when matched, and the tenantUserLookup controller handler returns the complete PlatformUser object without any field filtering or sanitization, exposing tenantId, userId, email, and ssoId fields. The endpoint accepts either an email address or user ID as input and enables user enumeration through differential response codes (HTTP 200 for existing users vs. HTTP 400 for non-existent users). No authentication is required; the vulnerability is remotely exploitable over the network via simple HTTP requests.
Affected products
- Budibase Budibase <3.40.0
Timeline
- 2026-07-22: disclosed
- 2026-07-24: patched: Version 3.40.0 released