Budibase CVE-2026-73304
MEDIUM
GHSA-fcrw-f7gg-6g9f
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Network-reachable API requires POWER-role authentication (PR:H); confidentiality is High due to OAuth2 refresh token exposure; no integrity or availability impact applies.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve the identity-provider credentials of SSO-authenticated users and use the refresh tokens for persistent access to connected services. This issue is fixed in version 3.39.25.
AnalysisAI
OAuth2 access and refresh tokens belonging to SSO-authenticated users are exposed via the /api/users/metadata and /api/users/metadata/:id endpoints in Budibase prior to version 3.39.25, accessible to any user holding the POWER role. The root cause is a missing output-sanitization step in packages/server/src/utilities/global.ts, which stripped passwords and roles but never removed oauth2.accessToken or oauth2.refreshToken from API responses. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three specific conditions must be met simultaneously. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.9 accurately reflects the PR:H requirement - exploitation is bounded to users already holding the POWER role, which is a meaningful prerequisite in well-administered instances. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a POWER-role Budibase account issues a GET request to `/api/users/metadata` with a valid session JWT and app-id header, as shown in the published PoC in GHSA-fcrw-f7gg-6g9f. The JSON response includes `oauth2.accessToken` and `oauth2.refreshToken` fields for every SSO-authenticated user on the platform. … |
| Remediation | The primary fix is to upgrade Budibase to version 3.39.25 or later, available at https://github.com/Budibase/budibase/releases/tag/3.39.25; the fixing commit is https://github.com/Budibase/budibase/commit/80a31f6c3354620aa90e50af8a2c614333084621 and the associated pull request is https://github.com/Budibase/budibase/pull/19110. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today