An unauthenticated request to the public endpoint GET /api/global/users/tenant/:id allows an attacker to obtain a full PlatformUser document, revealing tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata. This information disclosure can facilitate user enumeration and credential gathering, potentially aiding further attacks such as phishing or social engineering. The weakness is classified as CWE-200, user interface or API data exposure.

Budibase platform versions prior to 3.39.32 are affected. The vulnerability exists in the public endpoint handling used by the Budibase low‑code platform. All deployments of Budibase before the 3.39.32 release should be considered vulnerable.

The CVSS score of 7.5 indicates high severity, and the attack can be carried out by sending a simple unauthenticated HTTP GET request to a reachable instance. Because the endpoint is listed as public, no authentication or special privileges are required, making exploitation trivial for anyone who can reach the API server. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS and open access suggest a significant potential for exploitation.