The vulnerability is a cross‑tenant information disclosure that allows authenticated users to read metadata and source code of applications belonging to other tenants by sending a GET request to the /api/applications/:appId/appPackage endpoint. Without any authorization checks the endpoint returns sensitive data such as navigation structure, role names, internal screen URLs, JavaScript snippets and user identifiers.

Budibase server deployments running any version prior to 3.45.0 are affected. The issue is present in all instances of Budibase server where the /api/applications/:appId/appPackage endpoint is exposed, regardless of hosting environment.

The CVSS base score of 7.1 classifies this vulnerability as high severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalogue. Attackers only need authenticated access, which is typically available once they log into the application. By submitting a crafted appId belonging to a victim tenant, the attacker can retrieve application metadata and source code without any further privileges. The lack of authorization checks makes the exploit straightforward for any user who can supply an appId.