CVE-2026-73406 Budibase CVE debrief

Who should care

Defenders responsible for Budibase deployments, especially those with publicly accessible endpoints, should verify exposure and apply the patch. Budibase operators and security teams should review and restrict access to the affected endpoint and monitor for potential exploitation attempts.

Why it matters

CVE-2026-73406 allows unauthenticated disclosure of user information in Budibase. Defenders should verify exposure, apply the patch, and monitor for exploitation attempts.

• Verify and apply patch for Budibase versions prior to 3.39.32
• Restrict access to the affected endpoint
• Monitor for potential exploitation attempts

Technical summary

The Budibase platform had an issue where the GET /api/global/users/tenant/:id endpoint was listed in PUBLIC_ENDPOINTS, allowing unauthenticated callers to query user information, including email addresses and tenant identifiers. This issue is fixed in version 3.39.32. The vulnerability allows defenders to prioritize verifying exposure and applying the patch for Budibase versions prior to 3.39.32, especially those with publicly accessible endpoints. The fix involves updating the endpoint listing and restricting access.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch for Budibase versions prior to 3.39.32, especially those with publicly accessible endpoints.

Recommended defensive actions

• Verify Budibase version and apply patch if necessary
• Review and restrict access to the affected endpoint
• Monitor for potential exploitation attempts
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide details on the issue, which involves an endpoint listing in PUBLIC_ENDPOINTS and potential for user information disclosure. Official source references include commits, pull requests, and release notes from Budibase. The Budibase development team has addressed this issue in version 3.39.32. Evidence limits suggest defenders should verify Budibase deployments for exposure and apply the patch.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.