CVE-2026-73304

MediumCVSS 4.9

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

Budibase prior to version 3.39.25 has a vulnerability in the GET /api/users/metadata and GET /api/users/metadata/:id endpoints. Responses include user objects without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role can retrieve identity-provider credentials of SSO-authenticated users and use refresh tokens for persistent access to connected services.

Risk Assessment

A user with the POWER role can gain persistent access to SSO accounts and connected services, potentially leading to data confidentiality breaches and unauthorized actions.

Recommendation

Update Budibase to version 3.39.25 or later. Restrict access to user metadata endpoints and regularly review role permissions.

Original NVD description (English source)

Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve the identity-provider credentials of SSO-authenticated users and use the refresh tokens for persistent access to connected services. This issue is fixed in version 3.39.25.