Information Disclosure in Budibase Prior to 3.39.25

Executive Summary

This vulnerability in Budibase (CVE-2026-73301) involves an improper authorization check in the GET /api/global/groups endpoint. Prior to version 3.39.25, authenticated users with BASIC roles could access this endpoint and enumerate tenant groups, role mappings, user memberships, builder permissions, and default-group flags. The endpoint lacked the auth.builderOrAdmin middleware, exposing the tenant's access-control structure.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if unauthenticated or BASIC role users can access the GET /api/global/groups endpoint. Use curl commands like: curl -u user:password http://your-budibase-server/api/global/groups. If the endpoint returns group data for BASIC users, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker with BASIC role access could exploit this to gather sensitive information about your Budibase tenant's group structure, user roles, and permissions. This data could be used for further attacks like privilege escalation or targeted phishing. The impact is limited to information disclosure as no data modification or deletion is possible.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by exposing sensitive user data and access control structures. GDPR requires protecting personal data, and HIPAA mandates securing protected health information. Unauthorized access to group memberships and roles may violate these regulations, potentially leading to fines or legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Budibase to version 3.39.25 or later. Ensure the /api/global/groups endpoint enforces builderOrAdmin access. Review logs for unauthorized access attempts to this endpoint.

Useful 0 Not Useful 0