Vulnerability · Published Aug 13, 2026 · Assigned by GitHub_M

CVE-2026-73304Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

Medium 4.9

In plain English

A medium-severity information exposure in budibase from Budibase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)0.5%top 58.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve the identity-provider credentials of SSO-authenticated users and use the refresh tokens for persistent access to connected services. This issue is fixed in version 3.39.25.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@budibase/server	3.39.25	GHSA-fcrw-f7gg-6g9f

Affected products (as reported)

Vendor	Product	Versions
Budibase	budibase	< 3.39.25

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f x_refsource_CONFIRM
https://github.com/Budibase/budibase/pull/19110 x_refsource_MISC
https://github.com/Budibase/budibase/commit/80a31f6c3354620aa90e50af8a2c614333084621 x_refsource_MISC
https://github.com/Budibase/budibase/releases/tag/3.39.25 x_refsource_MISC