CVE-2026-73406

Published: Aug 12, 2026Modified: Sep 8, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier, distinguish existing users from missing users, and obtain tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata. This issue is fixed in version 3.39.32.

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (5)

https://github.com/Budibase/budibase/commit/0bdf648ff4c024a138a546ef84217e4efbee538e

Source: security-advisories@github.com

https://github.com/Budibase/budibase/pull/19221

Source: security-advisories@github.com

https://github.com/Budibase/budibase/releases/tag/3.39.32

Source: security-advisories@github.com

https://github.com/Budibase/budibase/security/advisories/GHSA-hr66-5mqr-8mpx

Source: security-advisories@github.com

https://github.com/Budibase/budibase/security/advisories/GHSA-hr66-5mqr-8mpx

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.