Medium severity4.9NVD Advisory· Published Aug 13, 2026· Updated Sep 8, 2026
CVE-2026-73304
CVE-2026-73304
Description
Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve the identity-provider credentials of SSO-authenticated users and use the refresh tokens for persistent access to connected services. This issue is fixed in version 3.39.25.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@budibase/servernpm | < 3.39.25 | 3.39.25 |
Affected products
1Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-fcrw-f7gg-6g9fghsaADVISORY
- github.com/Budibase/budibase/commit/7b8ba11a2c8b233c35e7728dd752dba25ef919a4ghsaWEB
- github.com/Budibase/budibase/commit/80a31f6c3354620aa90e50af8a2c614333084621nvdWEB
- github.com/Budibase/budibase/pull/19110nvdWEB
- github.com/Budibase/budibase/releases/tag/3.39.25nvdWEB
- github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9fnvdWEB
News mentions
1- Budibase: 24 Vulnerabilities Including SQLi, SSRF, and Auth Bypass Disclosed TogetherVypr Intelligence · Aug 14, 2026