GHSA-hr66-5mqr-8mpx: Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint
(updated )
The Budibase Worker service exposes a public, unauthenticated API endpoint (GET /api/global/users/tenant/:id) that returns sensitive user information including tenantId, userId, email, and ssoId. The endpoint is registered in the PUBLIC_ENDPOINTS list with a TODO comment acknowledging it “should be an internal API.” Any unauthenticated party can enumerate user emails or IDs to extract sensitive tenant and user metadata, enabling targeted attacks against multi-tenant deployments.
References
- github.com/Budibase/budibase/commit/e6bf245fbfdaa35804ef7ee901103282edf0c381
- github.com/Budibase/budibase/pull/19221
- github.com/Budibase/budibase/releases/tag/3.39.32
- github.com/Budibase/budibase/security/advisories/GHSA-hr66-5mqr-8mpx
- github.com/advisories/GHSA-hr66-5mqr-8mpx
- nvd.nist.gov/vuln/detail/CVE-2026-73406
Code Behaviors & Features
Detect and mitigate GHSA-hr66-5mqr-8mpx with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →