EUVD-2026-57432
GHSA-gh4h-34gr-87r7
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Co-builder role required (PR:L); victim must actively run a test (UI:R); only OAuth2 tokens are disclosed with no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.user.oauth2, broadcast BuilderSocketEvent.AutomationTestProgress to the app room, and stored progress in packages/server/src/automations/testProgress.ts without user scoping. A co-builder could receive or poll another SSO-authenticated builder test and obtain OAuth2 access and refresh tokens. The fix adds sanitizeAutomationTestResult and isolates progress by user. This issue is fixed in version 3.39.25.
AnalysisAI
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder credentials to any co-builder of the same application, in all versions prior to 3.39.25. When an SSO-authenticated user runs an automation test in the Budibase builder, the full trigger outputs - including the user's OAuth2 access and refresh tokens - are broadcast without sanitization via WebSocket to every builder connected to the same application room, and are simultaneously stored in a server-side in-memory cache accessible to any co-builder via the test status polling endpoint. A vendor-released patch is available in version 3.39.25; no active exploitation has been confirmed and no public proof-of-concept has been identified at time of analysis.
Technical ContextAI
Budibase is a Node.js low-code platform (CPE: cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*) that lets teams collaboratively build internal applications and automations through a shared builder UI. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), arising from an architectural gap between two correct-in-isolation subsystems. The getUserContextBindings() function in packages/server/src/sdk/users/utils.ts legitimately injects OAuth2 access and refresh tokens into user context bindings so automations can call external OAuth2-protected APIs on behalf of the authenticated user. However, the automation test controller in packages/server/src/api/controllers/automation.ts passed this full user object - including the oauth2 subtree - into the automation execution pipeline as trigger event data, where it was placed verbatim into trigger.outputs. These outputs were then (1) broadcast to the entire app builder WebSocket room via BuilderSocketEvent.AutomationTestProgress without filtering to the originating socket, and (2) stored in an in-memory Map in packages/server/src/automations/testProgress.ts keyed only by appId:automationId, with no per-user isolation. The fix introduces sanitizeAutomationTestResult to deep-clone and strip user.oauth2 from all trigger and step outputs before any broadcast or storage, and changes the cache key to appId:automationId:userId to enforce user-scoped isolation.
RemediationAI
Upgrade Budibase to version 3.39.25 or later, which is the vendor-released patch for this issue. The fix is available at https://github.com/Budibase/budibase/releases/tag/3.39.25 and corresponds to commit bca426de7dc36d680285295655dc640dea2aab21. For teams unable to patch immediately, the most targeted compensating control is to audit and restrict co-builder membership on applications where SSO-authenticated users run automation tests, ensuring that untrusted collaborators are removed from the builder role - note that this disrupts legitimate collaborative development workflows. A second compensating control is to disable OAuth2 token propagation into automation context if the affected automations do not actually require calling external OAuth2-protected APIs on behalf of the authenticated user; however, this will break any automation that relies on delegated API calls and must be evaluated per-application. No network-layer workaround exists because the exposure occurs within the authenticated builder session over legitimate application channels.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaS
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Unauthenticated account takeover of pending invited users in Budibase Server (@budibase/server) versions 3.41.0 through
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today