Information Exposure Affecting @budibase/worker package, versions *
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-BUDIBASEWORKER-18319713
- published26 Jul 2026
- disclosed24 Jul 2026
- creditUnknown
Introduced: 24 Jul 2026
New CVE NOT AVAILABLE CWE-200 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
@budibase/worker is a Budibase background service
Affected versions of this package are vulnerable to Information Exposure via the tenantUserLookup function. An attacker can obtain sensitive user and tenant information, including email addresses, user IDs, tenant IDs, SSO identifiers, and CouchDB revision tokens, by sending unauthenticated requests to a public API endpoint. The endpoint allows enumeration of users and tenants, enabling targeted attacks against multi-tenant deployments and facilitating further exploitation through user and tenant data harvesting.