CVE-2026-73304 Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users
Power-role users can retrieve SSO OAuth2 tokens from user metadata endpoints, enabling persistent access to connected services.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73304?
CVE-2026-73304 is a medium-severity vulnerability in budibase, published on 13 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve the identity-provider credentials of SSO-authenticated users and use the refresh tokens for persistent access to connected services. This issue is fixed in version 3.39.25.
Weakness: CWE-200
Which versions are affected by CVE-2026-73304?
2 open source packages ship an affected version, including @budibase/server.
| Package | Affected | Fixed in |
|---|---|---|
@budibase/server npm | All versions | 3.39.25 |
@budibase/server npm | All versions | 3.39.25 |
How do I fix CVE-2026-73304?
Upgrade @budibase/server to 3.39.25 or later.
Is CVE-2026-73304 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73304 exists.
Sources
Also known as GHSA-fcrw-f7gg-6g9f.