CVE-2026-73406: Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint
Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLICENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier, distinguish existing users from missing users, and obtain tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata. This issue is fixed in version 3.39.32.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.39.32
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73406?
The severity of CVE-2026-73406 is rated as high with a score of 7.5.
What does CVE-2026-73406 involve?
CVE-2026-73406 involves unauthenticated user information disclosure through a public tenant user lookup endpoint in Budibase.
How do I fix CVE-2026-73406?
To fix CVE-2026-73406, upgrade Budibase to version 3.39.32 or later where the issue has been resolved.
What type of vulnerability is CVE-2026-73406 classified as?
CVE-2026-73406 is classified as an information leak vulnerability.
Is user authentication required for CVE-2026-73406 exploitation?
No, CVE-2026-73406 can be exploited by unauthenticated users.