CyberRota Analysis
AI-GeneratedBudibase versions prior to 3.39.32 are vulnerable to an information disclosure flaw that allows unauthenticated users to access sensitive user data, including email addresses, user identifiers, and tenant identifiers, through the public API endpoint. This vulnerability poses a significant risk as it enables attackers to enumerate existing users and gather critical metadata. Organizations using affected versions should prioritize upgrading to 3.39.32 to mitigate potential data exposure risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier, distinguish existing users from missing users, and obtain tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata. This issue is fixed in version 3.39.32.