The vulnerability arises from the GET /api/global/groups endpoint not enforcing builder or administrator checks. An authenticated user with a BASIC role can request this endpoint and receive detailed information about tenant groups, role mappings, user memberships, builder permissions, and default-group flags. The impact is a compromise of confidentiality, revealing the organization’s access‑control structure without enabling further manipulation or direct privilege escalation. The weakness is classified as CWE-862, a missing authorization check.

Budibase open‑source low‑code platform, any version prior to 3.39.25. The fix is delivered in release 3.39.25. Only versions before 3.39.25 are affected; no later versions or other Budibase products are mentioned.

The CVSS score of 4.3 denotes a moderate risk level. The EPSS score is not available, so there is no published estimation of exploitation probability. The vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation yet. The likely attack vector is an authenticated request: any user who has obtained a BASIC‑level token can retrieve the information by sending a HTTP GET to the endpoint, meaning the threat exists in normal application use without additional compromise.