CVE-2026-73406

Received Received - Intake

Unauthenticated User Enumeration in Budibase

Publication date: 2026-08-12

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier, distinguish existing users from missing users, and obtain tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata. This issue is fixed in version 3.39.32.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-13

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-73406

EUVD

EUVD-2026-57433

Affected Vendors & Products

Vendor	Product	Version / Range
budibase	budibase	3.39.32

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability is an unauthenticated information disclosure issue in Budibase. An unauthenticated attacker can query a public API endpoint with an email or user ID to retrieve sensitive user details such as tenant IDs, user identifiers, email addresses, SSO identifiers, and document revision metadata. The endpoint was incorrectly listed as publicly accessible, allowing unauthorized access to user data without authentication.

Detection Guidance

To detect this vulnerability, check if the endpoint /api/global/users/tenant/:id is accessible without authentication. Use curl commands like 'curl -I http://<target>/api/global/users/tenant/test' to see if it returns sensitive data without requiring credentials. Compare responses for existing vs non-existing users to identify information leakage.

Impact Analysis

An attacker could exploit this to enumerate user accounts, confirm user existence, extract tenant IDs for cross-tenant attacks, and harvest SSO identifiers. This could lead to privacy breaches, targeted phishing, or unauthorized access to sensitive data. The impact is higher for multi-tenant cloud deployments where tenant isolation is critical.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal and sensitive user data. GDPR requires protecting personal data and ensuring data minimization, while HIPAA mandates safeguarding protected health information. The exposure of user emails, SSO identifiers, and tenant data could result in non-compliance, legal penalties, and reputational damage.

Mitigation Strategies

Immediately upgrade Budibase to version 3.39.32 or later. Remove the endpoint /api/global/users/tenant/:id from PUBLIC_ENDPOINTS and restrict it to internal routes only. Implement authentication checks for all API endpoints and limit returned user data fields to minimize exposure.

Hi! I’m here to help you understand CVE-2026-73406. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70