The Budibase Worker service has a public API endpoint GET /api/global/users/tenant/:id intended to be internal but currently accessible without authentication. This endpoint returns the complete PlatformUser object, including tenantId, userId, email, and ssoId, with no filtering or authorization checks. The endpoint is registered in the PUBLIC_ENDPOINTS list, causing the authentication middleware to bypass authentication. The handler accepts either an email or user ID and returns the full user document from CouchDB. This allows unauthenticated attackers to enumerate user emails and IDs, exposing sensitive tenant and user metadata in multi-tenant deployments.

An unauthenticated attacker can retrieve sensitive user information such as tenant identifiers, user IDs, email addresses, and single sign-on identifiers. This information disclosure could facilitate targeted attacks against tenants or users in multi-tenant environments. The vulnerability does not allow modification or denial of service but exposes confidential data, impacting confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint by network controls or reverse proxies to prevent unauthenticated access. Review and update endpoint registration to ensure internal APIs are not publicly accessible. Implement proper authentication and authorization checks on this endpoint to prevent unauthorized data disclosure.