EUVD-2026-57432
GHSA-gh4h-34gr-87r7
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Co-builder role required (PR:L); victim must actively run a test (UI:R); only OAuth2 tokens are disclosed with no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.user.oauth2, broadcast BuilderSocketEvent.AutomationTestProgress to the app room, and stored progress in packages/server/src/automations/testProgress.ts without user scoping. A co-builder could receive or poll another SSO-authenticated builder test and obtain OAuth2 access and refresh tokens. The fix adds sanitizeAutomationTestResult and isolates progress by user. This issue is fixed in version 3.39.25.
AnalysisAI
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder credentials to any co-builder of the same application, in all versions prior to 3.39.25. When an SSO-authenticated user runs an automation test in the Budibase builder, the full trigger outputs - including the user's OAuth2 access and refresh tokens - are broadcast without sanitization via WebSocket to every builder connected to the same application room, and are simultaneously stored in a server-side in-memory cache accessible to any co-builder via the test status polling endpoint. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following conditions to be satisfied simultaneously: first, the attacker must already hold co-builder access to the same Budibase application as the victim - co-builder is an authenticated, invitation-based role and cannot be self-assigned by external parties; second, the victim must be authenticated to Budibase via an SSO provider that populates OAuth2 tokens (the isSSOUser() check in getUserContextBindings() must be true and user.oauth2 must contain a non-empty accessToken) - users authenticating with local username/password or LDAP accounts are not affected; and third, the victim must actively trigger an automation test run in the builder UI while the attacker is either connected to the same WebSocket room or able to poll the test status endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.7 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) is well-calibrated: the network vector and low complexity reflect straightforward exploitation once inside the builder environment, while the required victim interaction (UI:R) and the need for existing co-builder access (PR:L) meaningfully constrain the attacker pool compared to unauthenticated network-exploitable flaws. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious co-builder of a shared Budibase application connects to the builder WebSocket room for the target app and waits for an SSO-authenticated colleague to initiate an automation test run. The attacker either passively receives the BuilderSocketEvent.AutomationTestProgress WebSocket broadcast - which at the time of the vulnerability contained the victim's full user context including oauth2.accessToken and oauth2.refreshToken - or actively polls the test status HTTP endpoint using the known appId and automationId, both of which are visible within the shared builder UI. … |
| Remediation | Upgrade Budibase to version 3.39.25 or later, which is the vendor-released patch for this issue. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Authentication bypass in Budibase low-code platform (versions prior to 3.35.4) allows remote unauthenticated attackers t
Remote code execution in Budibase versions prior to 3.33.4 allows unauthenticated attackers to execute arbitrary Bash co
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today