CVE-2026-73304: Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user object

Executive brief

Budibase is an open-source low-code platform for building web applications. The user metadata API endpoints allow users with POWER role to retrieve OAuth2 access and refresh tokens belonging to other users who authenticated via SSO (Google, OIDC), exposing external identity provider credentials. An attacker with POWER role can steal these tokens to impersonate SSO users and access their resources in Google Workspace, Azure AD, or other identity provider systems.

Technical details

The /api/users/metadata and /api/users/metadata/:id endpoints in @budibase/server fail to strip OAuth2 credentials from API responses. When users authenticate via SSO (OIDC or Google), the OAuth2 tokens are stored in the global CouchDB user document. The endpoints are protected by POWER role permission, but the processUser() function only removes password and role fields, leaving oauth2.accessToken and oauth2.refreshToken exposed. Any POWER-role user can enumerate all users via GET /api/users/metadata to retrieve stolen tokens without authentication to specific user IDs. The vulnerability requires POWER role in the application and network access to the API, but no user interaction. Fixed in version 3.40.0 via field stripping in the processUser() function.

Affected products

• Budibase @budibase/server < 3.40.0

Timeline

• 2026-07-24: disclosed
• 2026-07-22: patched: Version 3.40.0 / 3.39.25

References

• https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f
• https://github.com/Budibase/budibase/pull/19110