How should we interpret CVSS severity scores?

CVSS estimates technical severity, but it does not automatically equal business risk. Prioritize using context like internet exposure, asset criticality, known exploitation, and whether compensating controls exist. A Medium CVSS on an exposed production system can be more urgent than a Critical on an isolated non-production host.

Vulnerability Database

Q: What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

Q: What's the difference between a vulnerability, an exploit, and a zero-day?

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. Risk increases sharply when exploitation becomes reliable or widespread.

Q: Why do vulnerabilities keep reappearing in our environment?

Recurring findings usually come from incomplete asset discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host.

Q: How do we prioritize remediation without burning out the team?

Use a repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress so remediation is steady, not reactive.

Q: How can SynScan help reduce vulnerability risk over time?

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.

363,159

Total vulnerabilities in the database

Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint — @budibase / server

Exposure of Sensitive Information to an Unauthorized Actor

Summary

The Budibase Worker service exposes a public, unauthenticated API endpoint (GET /api/global/users/tenant/:id) that returns sensitive user information including tenantId, userId, email, and ssoId. The endpoint is registered in the PUBLIC_ENDPOINTS list with a TODO comment acknowledging it "should be an internal API." Any unauthenticated party can enumerate user emails or IDs to extract sensitive tenant and user metadata, enabling targeted attacks against multi-tenant deployments.

Details

Public endpoint registration at packages/worker/src/api/index.ts lines 56-59:

// TODO: This should be an internal api
{
  route: &quot;/api/global/users/tenant/:id&quot;,
  method: &quot;GET&quot;,
},

This endpoint is listed in PUBLIC_ENDPOINTS, which is passed to auth.buildAuthMiddleware(PUBLIC_ENDPOINTS) at line 154. When a request matches a public endpoint pattern, the authentication middleware sets ctx.publicEndpoint = true and calls next() without performing any authentication (verified at packages/backend-core/src/middleware/authenticated.ts lines 124-126, 249-251).

All subsequent middleware also skips for public endpoints:

buildTenancyMiddleware — passes through
activeTenant — passes through
buildCsrfMiddleware — skipped for GET methods (line 48 of csrf.ts)
The budibaseAccess gate at lines 160-168 explicitly returns next() when ctx.publicEndpoint is true

Route registration at packages/worker/src/api/routes/global/users.ts line 139:

loggedInRoutes
  .get(&quot;/api/global/users/tenant/:id&quot;, controller.tenantUserLookup)

loggedInRoutes has no auth middleware group — it is created with endpointGroupList.group() (no middleware).

Handler implementation at packages/worker/src/api/controllers/global/users.ts lines 548-562:

export const tenantUserLookup = async (
  ctx: UserCtx&lt;void, LookupTenantUserResponse&gt;
) =&gt; {
  const id = ctx.params.id
  // is email, check its valid
  if (id.includes(&quot;@&quot;) &amp;&amp; !emailValidator.validate(id)) {
    ctx.throw(400, `${id} is not a valid email address to lookup.`)
  }
  const user = await userSdk.core.getFirstPlatformUser(id)
  if (user) {
    ctx.body = user    // Returns full PlatformUser object — no field filtering
  } else {
    ctx.throw(400, &quot;No tenant user found.&quot;)
  }
}

The id parameter accepts either an email address (detected by @ presence) or a user ID. The response returns the full PlatformUser object from packages/types/src/documents/platform/users.ts:

export interface PlatformUserByEmail extends Document {
  tenantId: string    // Tenant identifier
  userId: string      // Internal user ID
}

export interface PlatformUserById extends Document {
  tenantId: string    // Tenant identifier
  email?: string      // User email address
  ssoId?: string      // SSO provider identifier
}

export interface PlatformUserBySsoId extends Document {
  tenantId: string    // Tenant identifier
  userId: string      // Internal user ID
  email: string       // User email address
  ssoId?: string      // SSO provider identifier
}

The lookup function (packages/backend-core/src/users/lookup.ts:48-53) queries the PLATFORM_USERS_LOWERCASE CouchDB view with include_docs: true, returning the complete platform user document including CouchDB _id and _rev.

Affected files:

packages/worker/src/api/index.ts:56-59 — Public endpoint registration
packages/worker/src/api/routes/global/users.ts:139 — Route on unauthenticated group
packages/worker/src/api/controllers/global/users.ts:548-562 — Handler returning full user object
packages/backend-core/src/users/lookup.ts:48-53 — Platform user lookup with include_docs: true
packages/types/src/documents/platform/users.ts:6-36 — PlatformUser types

PoC

Static verification:

Observe packages/worker/src/api/index.ts:56-59: endpoint in PUBLIC_ENDPOINTS with // TODO: This should be an internal api
Trace handler at packages/worker/src/api/controllers/global/users.ts:548-562: no auth checks, returns ctx.body = user (full object)
Trace middleware chain: all middleware passes through for ctx.publicEndpoint === true
Confirm no field filtering, sanitization, or authorization between request and response

Dynamic verification (requires running Budibase instance with at least one user):

# No authentication headers or cookies required
# Lookup by email:
curl -s http://localhost:4002/api/global/users/tenant/[email protected]

# Response (200 OK):
# {
#   &quot;_id&quot;: &quot;[email protected]&quot;,
#   &quot;_rev&quot;: &quot;1-abc123...&quot;,
#   &quot;tenantId&quot;: &quot;tenant-uuid-here&quot;,
#   &quot;userId&quot;: &quot;us_uuid-here&quot;
# }

# Lookup by user ID:
curl -s http://localhost:4002/api/global/users/tenant/us_someuserid123

# Response (200 OK):
# {
#   &quot;_id&quot;: &quot;us_someuserid123&quot;,
#   &quot;_rev&quot;: &quot;1-abc123...&quot;,
#   &quot;tenantId&quot;: &quot;tenant-uuid-here&quot;,
#   &quot;email&quot;: &quot;[email protected]&quot;,
#   &quot;ssoId&quot;: &quot;google-oauth-id&quot;
# }

# Non-existent user:
curl -s http://localhost:4002/api/global/users/tenant/[email protected]
# Response: 400 &quot;No tenant user found.&quot;
# (Different response confirms user enumeration)

Negative case: Requesting a non-existent user returns HTTP 400 with "No tenant user found.", while an existing user returns HTTP 200 with full data. The different status codes confirm user existence, enabling enumeration.

Impact

This is a CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability.

Who is impacted: All Budibase deployments — both self-hosted and cloud. The impact is highest for multi-tenant (cloud) deployments where tenant IDs are security boundaries and user enumeration across tenants enables targeted attacks.

An unauthenticated attacker can:

Enumerate all user accounts by testing known or guessed email addresses against the endpoint
Extract tenant IDs for any known user, enabling targeted cross-tenant attacks
Extract user IDs (userId) for use in other API calls or attacks
Extract SSO identifiers (ssoId) which may link to external identity providers (Google, OIDC)
Confirm user existence through different HTTP responses (200 vs 400)
Harvest CouchDB revision tokens (_rev) which could assist in CouchDB-level attacks

The returned tenant IDs are particularly dangerous in multi-tenant deployments because they identify the security boundary between organizations. Combined with the hardcoded session keys (separate finding), an attacker could use enumerated tenant IDs to craft targeted session fixation attacks.

Suggested remediation

Remove the endpoint from PUBLIC_ENDPOINTS and move it to internal-only routes, as the TODO comment at line 56 already suggests
Add authentication and authorization if the endpoint must remain accessible — require at least builderOrAdmin role
Limit returned fields to only what the consumer actually needs (strip _rev, ssoId, and other sensitive fields)
Return generic 404 for both "not found" and "access denied" to prevent user enumeration
Add rate limiting to prevent automated mass enumeration
Regression test: Add a test verifying GET /api/global/users/tenant/:id returns 403 without authentication

Published: Jul 24, 2026
Updated: Jul 25, 2026
GHSA: GHSA-hr66-5mqr-8mpx
Severity: High
Exploit:
CISA KEV:

CVSS v3:

Severity: High
Score: 7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWEs:

CWE-200

Affected Software
References

Software	From	Fixed in
@budibase / server	-	3.38.1.x

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo

Frequently Asked Questions

What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.