Vulnerability-Lookup

CVE-2026-73304 (GCVE-0-2026-73304)

Vulnerability from cvelistv5 – Published: 2026-08-13 22:05 – Updated: 2026-08-14 15:09

Title

Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

Summary

Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve the identity-provider credentials of SSO-authenticated users and use the refresh tokens for persistent access to connected services. This issue is fixed in version 3.39.25.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:08 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/Budibase/budibase/security/adv…	x_refsource_CONFIRM
https://github.com/Budibase/budibase/pull/19110	x_refsource_MISC
https://github.com/Budibase/budibase/commit/80a31…	x_refsource_MISC
https://github.com/Budibase/budibase/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Budibase	budibase	Affected: < 3.39.25

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73304",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:08:08.264692Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:09:18.395Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "budibase",
          "vendor": "Budibase",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.39.25"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve the identity-provider credentials of SSO-authenticated users and use the refresh tokens for persistent access to connected services. This issue is fixed in version 3.39.25."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T22:05:00.355Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f"
        },
        {
          "name": "https://github.com/Budibase/budibase/pull/19110",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Budibase/budibase/pull/19110"
        },
        {
          "name": "https://github.com/Budibase/budibase/commit/80a31f6c3354620aa90e50af8a2c614333084621",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Budibase/budibase/commit/80a31f6c3354620aa90e50af8a2c614333084621"
        },
        {
          "name": "https://github.com/Budibase/budibase/releases/tag/3.39.25",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Budibase/budibase/releases/tag/3.39.25"
        }
      ],
      "source": {
        "advisory": "GHSA-fcrw-f7gg-6g9f",
        "discovery": "UNKNOWN"
      },
      "title": "Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73304",
    "datePublished": "2026-08-13T22:05:00.355Z",
    "dateReserved": "2026-08-11T19:42:11.451Z",
    "dateUpdated": "2026-08-14T15:09:18.395Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73304",
      "date": "2026-08-15",
      "epss": "0.00356",
      "percentile": "0.28703"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-73304\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-13T22:17:25.500\",\"lastModified\":\"2026-08-14T16:17:00.100\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve the identity-provider credentials of SSO-authenticated users and use the refresh tokens for persistent access to connected services. This issue is fixed in version 3.39.25.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"Budibase\",\"product\":\"budibase\",\"versions\":[{\"version\":\"\u003c 3.39.25\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.2,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-14T15:08:08.264692Z\",\"id\":\"CVE-2026-73304\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"references\":[{\"url\":\"https://github.com/Budibase/budibase/commit/80a31f6c3354620aa90e50af8a2c614333084621\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Budibase/budibase/pull/19110\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Budibase/budibase/releases/tag/3.39.25\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users\", \"source\": {\"advisory\": \"GHSA-fcrw-f7gg-6g9f\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Budibase\", \"product\": \"budibase\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3.39.25\"}]}], \"references\": [{\"url\": \"https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f\", \"name\": \"https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/Budibase/budibase/pull/19110\", \"name\": \"https://github.com/Budibase/budibase/pull/19110\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Budibase/budibase/commit/80a31f6c3354620aa90e50af8a2c614333084621\", \"name\": \"https://github.com/Budibase/budibase/commit/80a31f6c3354620aa90e50af8a2c614333084621\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Budibase/budibase/releases/tag/3.39.25\", \"name\": \"https://github.com/Budibase/budibase/releases/tag/3.39.25\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve the identity-provider credentials of SSO-authenticated users and use the refresh tokens for persistent access to connected services. This issue is fixed in version 3.39.25.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-13T22:05:00.355Z\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-73304\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-14T15:08:08.264692Z\"}}}], \"references\": [{\"url\": \"https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2026-08-14T15:09:13.599Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-73304\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-13T22:05:00.355Z\", \"dateReserved\": \"2026-08-11T19:42:11.451Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-13T22:05:00.355Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-FCRW-F7GG-6G9F

Vulnerability from github – Published: 2026-07-24 21:14 – Updated: 2026-08-12 18:57

Summary

Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

Details

Summary

The /api/users/metadata and /api/users/metadata/:id endpoints in @budibase/server return full global user profiles to any user with POWER role or above. For SSO-authenticated users (OIDC, Google), the response includes oauth2.accessToken and oauth2.refreshToken fields, leaking identity provider credentials to other users who should not have access to them.

Details

When a user authenticates via SSO (OIDC or Google), the OAuth2 tokens are stored in the global CouchDB user document at packages/backend-core/src/auth/auth.ts:170-173:

dbUser.oauth2 = {
  ...dbUser.oauth2,
  ...details,
}
await db.put(dbUser)

The user metadata endpoints are protected by PermissionType.USER, PermissionLevel.READ (packages/server/src/api/routes/user.ts:11), which maps to the POWER permission set (packages/backend-core/src/security/permissions.ts:99).

Path 1 — List all users (GET /api/users/metadata): 1. controller.fetchMetadata → sdk.users.fetchMetadata() (packages/server/src/sdk/users/utils.ts:78) 2. → getGlobalUsers() → getRawGlobalUsers() (packages/server/src/utilities/global.ts:101-122) — strips only password and forceResetPassword 3. → processUser() (packages/server/src/utilities/global.ts:15-76) — strips only password and roles 4. The oauth2 field containing accessToken and refreshToken is never removed

Path 2 — Single user (GET /api/users/metadata/:id): 1. controller.findMetadata → getFullUser() (packages/server/src/utilities/users.ts:6) 2. → getGlobalUser() → getRawGlobalUser() (packages/server/src/utilities/global.ts:90-92) — raw CouchDB fetch, no field stripping at all 3. → processUser() — strips only password and roles 4. Same result: oauth2 tokens are returned

There is no output sanitization middleware on these routes that would strip sensitive fields before the response reaches the client.

PoC

Prerequisites: A Budibase instance with at least one SSO-authenticated user (OIDC or Google) and a separate user with POWER role in an app.

Step 1 — As the POWER user, list all users:

curl -s -X GET 'http://localhost:10000/api/users/metadata' \
  -H 'Cookie: budibase:auth=<power-user-jwt>' \
  -H 'x-budibase-app-id: app_<appid>' | jq '.[].oauth2'

Expected output: null for all users (tokens should not be exposed)

Actual output: For SSO users, the response includes:

{
  "accessToken": "ya29.a0ARrdaM...",
  "refreshToken": "1//0eXxXxXxXx..."
}

Step 2 — Fetch a specific SSO user's profile:

curl -s -X GET 'http://localhost:10000/api/users/metadata/ro_ta_users_us_<sso-user-id>' \
  -H 'Cookie: budibase:auth=<power-user-jwt>' \
  -H 'x-budibase-app-id: app_<appid>' | jq '.oauth2'

This also returns the full OAuth2 tokens.

Impact

A user with POWER role in any app can read all SSO users' OAuth2 access tokens and refresh tokens via the list endpoint, without needing to know individual user IDs.
Stolen access tokens can be used to access external identity provider resources (Google Workspace, Azure AD, Okta-protected services) as the victim user.
Refresh tokens allow indefinite token renewal, persisting access even after the original access token expires.
Additionally, admin, builder, tenantId, ssoId, and userGroups fields are leaked, revealing the full authorization topology of the instance.

Recommended Fix

Strip sensitive SSO fields in processUser() at packages/server/src/utilities/global.ts:15:

export async function processUser(
  user: ContextUser,
  opts: { appId?: string; groups?: UserGroup[] } = {}
) {
  if (!user || (!user.roles && !user.userGroups)) {
    return user
  }
  user = cloneDeep(user)
  delete user.password
+ delete (user as any).oauth2
+ delete (user as any).provider
+ delete (user as any).providerType
+ delete (user as any).thirdPartyProfile
+ delete (user as any).profile
+ delete (user as any).ssoId
+ delete (user as any).forceResetPassword
  // ... rest of function

Additionally, getRawGlobalUsers() at line 101 should also strip oauth2 alongside its existing password/forceResetPassword stripping for defense in depth.

Severity

4.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@budibase/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.39.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73304"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T21:14:31Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `/api/users/metadata` and `/api/users/metadata/:id` endpoints in `@budibase/server` return full global user profiles to any user with POWER role or above. For SSO-authenticated users (OIDC, Google), the response includes `oauth2.accessToken` and `oauth2.refreshToken` fields, leaking identity provider credentials to other users who should not have access to them.\n\n## Details\n\nWhen a user authenticates via SSO (OIDC or Google), the OAuth2 tokens are stored in the global CouchDB user document at `packages/backend-core/src/auth/auth.ts:170-173`:\n\n```typescript\ndbUser.oauth2 = {\n  ...dbUser.oauth2,\n  ...details,\n}\nawait db.put(dbUser)\n```\n\nThe user metadata endpoints are protected by `PermissionType.USER, PermissionLevel.READ` (`packages/server/src/api/routes/user.ts:11`), which maps to the POWER permission set (`packages/backend-core/src/security/permissions.ts:99`).\n\n**Path 1 \u2014 List all users** (`GET /api/users/metadata`):\n1. `controller.fetchMetadata` \u2192 `sdk.users.fetchMetadata()` (`packages/server/src/sdk/users/utils.ts:78`)\n2. \u2192 `getGlobalUsers()` \u2192 `getRawGlobalUsers()` (`packages/server/src/utilities/global.ts:101-122`) \u2014 strips only `password` and `forceResetPassword`\n3. \u2192 `processUser()` (`packages/server/src/utilities/global.ts:15-76`) \u2014 strips only `password` and `roles`\n4. The `oauth2` field containing `accessToken` and `refreshToken` is **never removed**\n\n**Path 2 \u2014 Single user** (`GET /api/users/metadata/:id`):\n1. `controller.findMetadata` \u2192 `getFullUser()` (`packages/server/src/utilities/users.ts:6`)\n2. \u2192 `getGlobalUser()` \u2192 `getRawGlobalUser()` (`packages/server/src/utilities/global.ts:90-92`) \u2014 raw CouchDB fetch, **no field stripping at all**\n3. \u2192 `processUser()` \u2014 strips only `password` and `roles`\n4. Same result: `oauth2` tokens are returned\n\nThere is no output sanitization middleware on these routes that would strip sensitive fields before the response reaches the client.\n\n## PoC\n\n**Prerequisites:** A Budibase instance with at least one SSO-authenticated user (OIDC or Google) and a separate user with POWER role in an app.\n\n**Step 1 \u2014 As the POWER user, list all users:**\n```bash\ncurl -s -X GET \u0027http://localhost:10000/api/users/metadata\u0027 \\\n  -H \u0027Cookie: budibase:auth=\u003cpower-user-jwt\u003e\u0027 \\\n  -H \u0027x-budibase-app-id: app_\u003cappid\u003e\u0027 | jq \u0027.[].oauth2\u0027\n```\n\n**Expected output:** `null` for all users (tokens should not be exposed)\n\n**Actual output:** For SSO users, the response includes:\n```json\n{\n  \"accessToken\": \"ya29.a0ARrdaM...\",\n  \"refreshToken\": \"1//0eXxXxXxXx...\"\n}\n```\n\n**Step 2 \u2014 Fetch a specific SSO user\u0027s profile:**\n```bash\ncurl -s -X GET \u0027http://localhost:10000/api/users/metadata/ro_ta_users_us_\u003csso-user-id\u003e\u0027 \\\n  -H \u0027Cookie: budibase:auth=\u003cpower-user-jwt\u003e\u0027 \\\n  -H \u0027x-budibase-app-id: app_\u003cappid\u003e\u0027 | jq \u0027.oauth2\u0027\n```\n\nThis also returns the full OAuth2 tokens.\n\n## Impact\n\n- A user with POWER role in any app can read **all SSO users\u0027 OAuth2 access tokens and refresh tokens** via the list endpoint, without needing to know individual user IDs.\n- Stolen access tokens can be used to access external identity provider resources (Google Workspace, Azure AD, Okta-protected services) as the victim user.\n- Refresh tokens allow indefinite token renewal, persisting access even after the original access token expires.\n- Additionally, `admin`, `builder`, `tenantId`, `ssoId`, and `userGroups` fields are leaked, revealing the full authorization topology of the instance.\n\n## Recommended Fix\n\nStrip sensitive SSO fields in `processUser()` at `packages/server/src/utilities/global.ts:15`:\n\n```typescript\nexport async function processUser(\n  user: ContextUser,\n  opts: { appId?: string; groups?: UserGroup[] } = {}\n) {\n  if (!user || (!user.roles \u0026\u0026 !user.userGroups)) {\n    return user\n  }\n  user = cloneDeep(user)\n  delete user.password\n+ delete (user as any).oauth2\n+ delete (user as any).provider\n+ delete (user as any).providerType\n+ delete (user as any).thirdPartyProfile\n+ delete (user as any).profile\n+ delete (user as any).ssoId\n+ delete (user as any).forceResetPassword\n  // ... rest of function\n```\n\nAdditionally, `getRawGlobalUsers()` at line 101 should also strip `oauth2` alongside its existing `password`/`forceResetPassword` stripping for defense in depth.",
  "id": "GHSA-fcrw-f7gg-6g9f",
  "modified": "2026-08-12T18:57:12Z",
  "published": "2026-07-24T21:14:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/pull/19110"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/commit/7b8ba11a2c8b233c35e7728dd752dba25ef919a4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/commit/80a31f6c3354620aa90e50af8a2c614333084621"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Budibase/budibase"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/releases/tag/3.39.25"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": " Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-73304 (GCVE-0-2026-73304)

GHSA-FCRW-F7GG-6G9F

Summary

Details

PoC

Impact

Recommended Fix

Tags

Sightings

Nomenclature