CVE-2026-73406 Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLICENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier,...

CVE-2026-73406 Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLICENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier,...

Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

Summary The Budibase Worker service exposes a public, unauthenticated API endpoint GET /api/global/users/tenant/:id that returns sensitive user information including tenantId, userId, email, and ssoId. The endpoint is registered in the PUBLICENDPOINTS list with a TODO comment acknowledging it...