The GET /api/global/groups endpoint in Budibase's worker service does not enforce role-based authorization middleware, unlike other group-related endpoints. As a result, any authenticated user, including those with only BASIC privileges, can retrieve detailed information about all user groups in the tenant. This includes group names, colors, icons, app access roles, user membership lists, builder permission flags, and the isDefault flag. The root cause is the absence of auth.builderOrAdmin middleware on this endpoint, which is present on other group endpoints. This flaw allows unauthorized enumeration of organizational access control structures.

Authenticated users with BASIC roles can access sensitive information about all user groups and their role mappings within a tenant. This exposure reveals organizational access control details, including which users belong to which groups and their permissions. While it does not directly allow privilege escalation or data modification, it facilitates reconnaissance that could be leveraged in further attacks or privilege escalation attempts.

A fix is available by adding the auth.builderOrAdmin authorization middleware to the GET /api/global/groups endpoint. This change restricts access to users with builder or admin roles, preventing BASIC users from enumerating group information. Until patched, restrict access to trusted users or monitor for unauthorized access attempts. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.