CVE-2026-73406

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier, distinguish existing users from missing users, and obtain tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata. This issue is fixed in version 3.39.32.

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier, distinguish existing users from missing users, and obtain tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata. This issue is fixed in version 3.39.32.

Summary

The Budibase Worker service exposes a public, unauthenticated API endpoint (GET /api/global/users/tenant/:id) that returns sensitive user information including tenantId, userId, email, and ssoId. The endpoint is registered in the PUBLIC_ENDPOINTS list with a TODO comment acknowledging it "should be an internal API." Any unauthenticated party can enumerate user emails or IDs to extract sensitive tenant and user metadata, enabling targeted attacks against multi-tenant deployments.

Details

Public endpoint registration at packages/worker/src/api/index.ts lines 56-59:

// TODO: This should be an internal api
{
  route: "/api/global/users/tenant/:id",
  method: "GET",
},

This endpoint is listed in PUBLIC_ENDPOINTS, which is passed to auth.buildAuthMiddleware(PUBLIC_ENDPOINTS) at line 154. When a request matches a public endpoint pattern, the authentication middleware sets ctx.publicEndpoint = true and calls next() without performing any authentication (verified at packages/backend-core/src/middleware/authenticated.ts lines 124-126, 249-251).

All subsequent middleware also skips for public endpoints:

• buildTenancyMiddleware — passes through
• activeTenant — passes through
• buildCsrfMiddleware — skipped for GET methods (line 48 of csrf.ts)
• The budibaseAccess gate at lines 160-168 explicitly returns next() when ctx.publicEndpoint is true

Route registration at packages/worker/src/api/routes/global/users.ts line 139:

loggedInRoutes
  .get("/api/global/users/tenant/:id", controller.tenantUserLookup)

loggedInRoutes has no auth middleware group — it is created with endpointGroupList.group() (no middleware).

Handler implementation at packages/worker/src/api/controllers/global/users.ts lines 548-562:

export const tenantUserLookup = async (
  ctx: UserCtx<void, LookupTenantUserResponse>
) => {
  const id = ctx.params.id
  // is email, check its valid
  if (id.includes("@") && !emailValidator.validate(id)) {
    ctx.throw(400, `${id} is not a valid email address to lookup.`)
  }
  const user = await userSdk.core.getFirstPlatformUser(id)
  if (user) {
    ctx.body = user    // Returns full PlatformUser object — no field filtering
  } else {
    ctx.throw(400, "No tenant user found.")
  }
}

The id parameter accepts either an email address (detected by @ presence) or a user ID. The response returns the full PlatformUser object from packages/types/src/documents/platform/users.ts:

export interface PlatformUserByEmail extends Document {
  tenantId: string    // Tenant identifier
  userId: string      // Internal user ID
}

export interface PlatformUserById extends Document {
  tenantId: string    // Tenant identifier
  email?: string      // User email address
  ssoId?: string      // SSO provider identifier
}

export interface PlatformUserBySsoId extends Document {
  tenantId: string    // Tenant identifier
  userId: string      // Internal user ID
  email: string       // User email address
  ssoId?: string      // SSO provider identifier
}

The lookup function (packages/backend-core/src/users/lookup.ts:48-53) queries the PLATFORM_USERS_LOWERCASE CouchDB view with include_docs: true, returning the complete platform user document including CouchDB _id and _rev.

Affected files:

• packages/worker/src/api/index.ts:56-59 — Public endpoint registration
• packages/worker/src/api/routes/global/users.ts:139 — Route on unauthenticated group
• packages/worker/src/api/controllers/global/users.ts:548-562 — Handler returning full user object
• packages/backend-core/src/users/lookup.ts:48-53 — Platform user lookup with include_docs: true
• packages/types/src/documents/platform/users.ts:6-36 — PlatformUser types

PoC

Static verification:

1. Observe packages/worker/src/api/index.ts:56-59: endpoint in PUBLIC_ENDPOINTS with `// TODO:…

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier, distinguish existing users from missing users, and obtain tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata. This issue is fixed in version 3.39.32.

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier, distinguish existing users from missing users, and obtain tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata. This issue is fixed in version 3.39.32.

Summary

The Budibase Worker service exposes a public, unauthenticated API endpoint (GET /api/global/users/tenant/:id) that returns sensitive user information including tenantId, userId, email, and ssoId. The endpoint is registered in the PUBLIC_ENDPOINTS list with a TODO comment acknowledging it "should be an internal API." Any unauthenticated party can enumerate user emails or IDs to extract sensitive tenant and user metadata, enabling targeted attacks against multi-tenant deployments.

Details

Public endpoint registration at packages/worker/src/api/index.ts lines 56-59:

// TODO: This should be an internal api
{
  route: "/api/global/users/tenant/:id",
  method: "GET",
},

This endpoint is listed in PUBLIC_ENDPOINTS, which is passed to auth.buildAuthMiddleware(PUBLIC_ENDPOINTS) at line 154. When a request matches a public endpoint pattern, the authentication middleware sets ctx.publicEndpoint = true and calls next() without performing any authentication (verified at packages/backend-core/src/middleware/authenticated.ts lines 124-126, 249-251).

All subsequent middleware also skips for public endpoints:

• buildTenancyMiddleware — passes through
• activeTenant — passes through
• buildCsrfMiddleware — skipped for GET methods (line 48 of csrf.ts)
• The budibaseAccess gate at lines 160-168 explicitly returns next() when ctx.publicEndpoint is true

Route registration at packages/worker/src/api/routes/global/users.ts line 139:

loggedInRoutes
  .get("/api/global/users/tenant/:id", controller.tenantUserLookup)

loggedInRoutes has no auth middleware group — it is created with endpointGroupList.group() (no middleware).

Handler implementation at packages/worker/src/api/controllers/global/users.ts lines 548-562:

export const tenantUserLookup = async (
  ctx: UserCtx<void, LookupTenantUserResponse>
) => {
  const id = ctx.params.id
  // is email, check its valid
  if (id.includes("@") && !emailValidator.validate(id)) {
    ctx.throw(400, `${id} is not a valid email address to lookup.`)
  }
  const user = await userSdk.core.getFirstPlatformUser(id)
  if (user) {
    ctx.body = user    // Returns full PlatformUser object — no field filtering
  } else {
    ctx.throw(400, "No tenant user found.")
  }
}

The id parameter accepts either an email address (detected by @ presence) or a user ID. The response returns the full PlatformUser object from packages/types/src/documents/platform/users.ts:

export interface PlatformUserByEmail extends Document {
  tenantId: string    // Tenant identifier
  userId: string      // Internal user ID
}

export interface PlatformUserById extends Document {
  tenantId: string    // Tenant identifier
  email?: string      // User email address
  ssoId?: string      // SSO provider identifier
}

export interface PlatformUserBySsoId extends Document {
  tenantId: string    // Tenant identifier
  userId: string      // Internal user ID
  email: string       // User email address
  ssoId?: string      // SSO provider identifier
}

The lookup function (packages/backend-core/src/users/lookup.ts:48-53) queries the PLATFORM_USERS_LOWERCASE CouchDB view with include_docs: true, returning the complete platform user document including CouchDB _id and _rev.

Affected files:

• packages/worker/src/api/index.ts:56-59 — Public endpoint registration
• packages/worker/src/api/routes/global/users.ts:139 — Route on unauthenticated group
• packages/worker/src/api/controllers/global/users.ts:548-562 — Handler returning full user object
• packages/backend-core/src/users/lookup.ts:48-53 — Platform user lookup with include_docs: true
• packages/types/src/documents/platform/users.ts:6-36 — PlatformUser types

PoC

Static verification:

1. Observe packages/worker/src/api/index.ts:56-59: endpoint in PUBLIC_ENDPOINTS with `// TODO:…