Summary On a self-hosted, single-tenant Budibase instance (`multiTenancy:false`), the public bootstrap endpoint `POST /api/global/users/init` remains fully exploitable after the instance has been provisioned. Its "already initialised" guard (`checkAnyUserExists()`) is evaluated inside a tenant-scoped database context derived from an attacker-controlled `tenantId` in the request body. Because the tenancy layer never constrains that `tenantId` to the only legitimate tenant (`default`) on a single-tenant deployment, an unauthenticated attacker simply supplies any unused tenant name to make the guard see an empty user list, and the endpoint then creates a brand-new CouchDB database (`<tenantId>_global-db`) and a global-admin user document (`admin.global = true`, `builder.global = true`) inside it - with no authentication and no CSRF token. This is (a) a bypass of the security control meant to permanently close first-run setup, and (b) an unauthenticated, persistent write primitive that lets an anonymous attacker create an unbounded number of databases and admin-user documents - a resource-exhaustion / denial-of-service vector against the CouchDB datastore, plus creation of latent rogue admin accounts.