CVE-2026-73406: Budibase Information Disclosure Flaw

CVE-2026-73406 Overview

CVE-2026-73406 is an information disclosure vulnerability in Budibase, an open-source low-code platform. The endpoint GET /api/global/users/tenant/:id was registered in PUBLIC_ENDPOINTS inside packages/worker/src/api/index.ts, exposing the tenantUserLookup handler without authentication. The handler returned a complete PlatformUser document. Unauthenticated attackers can enumerate accounts, distinguish existing users from missing ones, and extract tenant identifiers, user identifiers, email addresses, single sign-on (SSO) identifiers, and document revision metadata. The issue is fixed in Budibase version 3.39.32.

Critical Impact
Remote attackers can enumerate valid accounts and harvest tenant, SSO, and email metadata without credentials, enabling targeted phishing and follow-on identity attacks.

Affected Products

Budibase versions prior to 3.39.32
Self-hosted Budibase worker service exposing /api/global/users/tenant/:id
Multi-tenant Budibase deployments where tenant identifiers are considered non-public

Discovery Timeline

2026-08-12 - CVE-2026-73406 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73406

Vulnerability Analysis

The vulnerability is an information exposure flaw classified under [CWE-200]. The Budibase worker service maintains a PUBLIC_ENDPOINTS array that whitelists routes bypassing authentication middleware. The route /api/global/users/tenant/:id was mistakenly included in that array, marked by an inline TODO comment indicating it should have been designated an internal API. As a result, the tenantUserLookup handler processed anonymous requests and returned the raw PlatformUser document for the queried identifier or email.

Because responses differ between existing and non-existent users, attackers can perform account enumeration by iterating over candidate emails. Returned records include tenant identifiers, user identifiers, email addresses, SSO identifiers, and CouchDB _rev metadata that reveals document modification history.

Root Cause

The root cause is a misconfigured route registration in packages/worker/src/api/index.ts. The tenant user lookup endpoint was declared as public rather than internal, so no authentication or authorization check gated access to sensitive user records.

Attack Vector

Exploitation requires only network reachability to the Budibase worker HTTP interface. An unauthenticated attacker issues a GET request against /api/global/users/tenant/:id, supplying an email or user identifier as the path parameter. The server responds with the full PlatformUser document when the record exists and a distinguishable response when it does not, enabling enumeration and metadata collection at scale.

typescript

     method: "GET",
   },
   // TODO: This should be an internal api
-  {
-    route: "/api/global/users/tenant/:id",
-    method: "GET",
-  },
-  // TODO: This should be an internal api
   {
     route: "/api/system/restored",
     method: "POST",

Source: Budibase commit 0bdf648 — the patch removes the tenant user lookup route from PUBLIC_ENDPOINTS, restoring authentication enforcement.

Detection Methods for CVE-2026-73406

Indicators of Compromise

Unauthenticated GET requests to /api/global/users/tenant/ paths in Budibase worker access logs.
Bursts of sequential or dictionary-style path parameters against the tenant lookup endpoint, indicative of enumeration.
Response bodies containing PlatformUser fields such as tenantId, ssoId, and _rev returned to clients without prior authentication.

Detection Strategies

Review Budibase worker logs and upstream reverse proxy logs for requests to /api/global/users/tenant/:id originating from unauthenticated sessions.
Alert on high-volume request patterns to the tenant lookup route from a single source IP or user agent within short time windows.
Correlate spikes in tenant lookup traffic with subsequent phishing waves or SSO login attempts targeting harvested email addresses.

Monitoring Recommendations

Ingest Budibase worker and web-tier access logs into a centralized log platform with retention sufficient for enumeration investigations.
Baseline normal request volume to /api/global/users/* routes and alert on statistical deviations.
Track outbound identity provider authentication failures for accounts enumerated during suspected exploitation windows.

How to Mitigate CVE-2026-73406

Immediate Actions Required

Upgrade Budibase to version 3.39.32 or later on all self-hosted worker instances.
Audit worker access logs retroactively for unauthenticated requests to /api/global/users/tenant/:id and identify any enumerated accounts.
Notify potentially exposed users and consider forcing SSO session resets where enumeration is confirmed.

Patch Information

The fix is available in Budibase 3.39.32, delivered via pull request #19221 and commit 0bdf648. The patch removes /api/global/users/tenant/:id from PUBLIC_ENDPOINTS, restoring authentication enforcement. Refer to GHSA-hr66-5mqr-8mpx for the vendor advisory.

Workarounds

Block unauthenticated requests to /api/global/users/tenant/:id at an upstream reverse proxy or web application firewall (WAF) until the upgrade is deployed.
Restrict network exposure of the Budibase worker service to trusted networks or VPN clients pending remediation.
Rate-limit requests to /api/global/users/* endpoints to slow account enumeration attempts.

bash

# Example NGINX rule to block unauthenticated access to the vulnerable route
location ~ ^/api/global/users/tenant/ {
    if ($http_authorization = "") {
        return 401;
    }
    limit_req zone=budibase_lookup burst=5 nodelay;
    proxy_pass http://budibase_worker;
}