# CVE-2026-73304: Budibase SSO OAuth2 token leakage via user metadata endpoints

Source: https://junglewise.ai/threats/cve-2026-73304-budibase-sso-oauth2-token-leakage-via-user-metadata-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73304 · Severity: medium · CVSS 4.9 · Published 2026-08-13

Budibase is an open-source low-code platform for building web applications. The user metadata API endpoints allow users with POWER role to retrieve OAuth2 access and refresh tokens belonging to other users who authenticated via SSO (Google, OIDC), exposing external identity provider credentials. An attacker with POWER role can steal these tokens to impersonate SSO users and access their resources in Google Workspace, Azure AD, or other identity provider systems.

Technologies: [@budibase/server (npm)](https://junglewise.ai/threats/technologies/budibase-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-73304 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73304 being exploited in the wild.

**How severe is CVE-2026-73304?** Medium severity, with a CVSS score of 4.9, published 13 August 2026.

**Which products and versions are affected?** @budibase/server (npm) SEMVER:introduced=0,fixed=3.39.25.

**Is there a fix for CVE-2026-73304?** Yes. @budibase/server (npm): upgrade to 3.39.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73304 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73304?** Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @budibase/server (npm): upgrade to 3.39.25 or later

  ```sh
  npm install @budibase/server@3.39.25
  ```


## Technical details

The /api/users/metadata and /api/users/metadata/:id endpoints in @budibase/server fail to strip OAuth2 credentials from API responses. When users authenticate via SSO (OIDC or Google), the OAuth2 tokens are stored in the global CouchDB user document. The endpoints are protected by POWER role permission, but the processUser() function only removes password and role fields, leaving oauth2.accessToken and oauth2.refreshToken exposed. Any POWER-role user can enumerate all users via GET /api/users/metadata to retrieve stolen tokens without authentication to specific user IDs. The vulnerability requires POWER role in the application and network access to the API, but no user interaction. Fixed in version 3.40.0 via field stripping in the processUser() function.

## Affected products

- Budibase @budibase/server < 3.40.0

## Identifiers

- CVE-2026-73304
- GHSA-fcrw-f7gg-6g9f

## Timeline

- 2026-07-24: disclosed
- 2026-07-22: patched: Version 3.40.0 / 3.39.25

## References

- [https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f](https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f)
- [https://github.com/Budibase/budibase/pull/19110](https://github.com/Budibase/budibase/pull/19110)

## Related threats

- [Budibase S3 signed upload URL issuance via attachments endpoint](https://junglewise.ai/threats/cve-2026-54356-budibase-s3-signed-upload-url-issuance-via-attachments-endpoint)
- [Budibase automation SSRF in webhook and integration steps](https://junglewise.ai/threats/cve-2026-35219-budibase-automation-ssrf-in-webhook-and-integration-steps)
- [Budibase S3 presigned URL authorization regression](https://junglewise.ai/threats/cve-2026-72859-budibase-s3-presigned-url-authorization-regression)
- [Budibase MySQL DESCRIBE backtick injection via multipleStatements](https://junglewise.ai/threats/cve-2026-73408-budibase-mysql-describe-backtick-injection-via-multiplestatements)
- [Budibase privilege escalation in public role assignment API](https://junglewise.ai/threats/cve-2026-73305-budibase-privilege-escalation-in-public-role-assignment-api)