CVE-2026-73304— Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users
Quick assessment
Affected
Budibase budibase
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Budibase是英国Budibase公司开源的一个低代码应用开发平台。 Budibase 3.39.25之前版本存在信息泄露漏洞，该漏洞源于GET /api/users/metadata和GET /api/users/metadata/:id接口通过packages/server/src/utilities/global.ts处理用户对象时未移除oauth2.accessToken或oauth2.refreshToken，可能导致具有POWER角色的用户检索SSO认证用户的身份提供商凭据，并利用刷新令牌
Possible ATT&CK Techniques 1 AI
T1552.004 · Private Keys
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-73304
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users
Source: CVE Program / CVE List V5
Vulnerability Description
Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve the identity-provider credentials of SSO-authenticated users and use the refresh tokens for persistent access to connected services. This issue is fixed in version 3.39.25.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Budibase 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Budibase是英国Budibase公司开源的一个低代码应用开发平台。 Budibase 3.39.25之前版本存在信息泄露漏洞，该漏洞源于GET /api/users/metadata和GET /api/users/metadata/:id接口通过packages/server/src/utilities/global.ts处理用户对象时未移除oauth2.accessToken或oauth2.refreshToken，可能导致具有POWER角色的用户检索SSO认证用户的身份提供商凭据，并利用刷新令牌
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-73304
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73304
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-73304 (1)
Vendor Advisories for CVE-2026-73304 (1)
Vendor Pages for CVE-2026-73304 (1)
-
🔗 Release 3.39.25 · Budibase/budibase · GitHub x_refsource_MISC
Same Patch Batch · Budibase · 2026-08-13 · 13 CVEs total
| CVE-2026-72851 | 10.0 CRITICAL | Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook |
| CVE-2026-72850 | 9.1 CRITICAL | Budibase before 3.40.0 Arbitrary File Write via Path Traversal |
| CVE-2026-73302 | 9.0 CRITICAL | Budibase: OIDC SSO account takeover: incoming identity linked by email without checking em |
| CVE-2026-73305 | 8.8 HIGH | Budibase: Privilege escalation via public role assignment API missing app-level authorizat |
| CVE-2026-72855 | 8.5 HIGH | Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST |
| CVE-2026-73618 | 8.3 HIGH | Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter |
| CVE-2026-72856 | 8.1 HIGH | Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email |
| CVE-2026-72857 | 7.7 HIGH | Budibase before 3.40.0 Credential Exposure via STRING Fields |
| CVE-2026-72849 | 7.7 HIGH | Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF |
| CVE-2026-72853 | 7.6 HIGH | Budibase before 3.40.0 SQL Injection via Oracle connector |
| CVE-2026-73408 | 7.6 HIGH | Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector |
| CVE-2026-73617 | 7.1 HIGH | Budibase before 3.40.0 NoSQL Injection via MongoDB datasource |
IV. Related Vulnerabilities
Same product: budibase
-
CVE-2026-54356
Budibase authenticated arbitrary S3 signed upload URL issuan -
CVE-2026-35219
Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, S -
CVE-2026-73410
Budibase: SSRF via DNS rebinding in the REST datasource inte -
CVE-2026-64657
Budibase: Database Connector SQL Injections in PostgreSQL, M -
CVE-2026-73305
Budibase: Privilege escalation via public role assignment AP
Same vendor: Budibase
-
CVE-2026-100688
Budibase server before 3.45.0 Cross-Tenant Information Discl -
CVE-2026-100686
Budibase before 3.45.0 Cross-Workspace Privilege Escalation -
CVE-2026-100687
Budibase Server before 3.45.0 Credential Exposure via Extern -
CVE-2026-100685
Budibase before 3.45.0 Information Disclosure via Chat Links -
CVE-2026-100684
Budibase Server 3.41.0 before 3.45.0 Authentication Bypass v
Same weakness: CWE-200
-
CVE-2026-92548
WP Popular Posts <= 7.4.2 - Unauthenticated Information Disc -
CVE-2026-102121
Kiteworks Secure Data Forms Exposure of Sensitive Informatio -
CVE-2026-47514
NVIDIA驱动内核栈信息泄露漏洞 -
CVE-2026-102845
gedelumbung HospitalManagement HTTP Response index.php error -
CVE-2026-90441
Fireware OS Missing Authorization in wgagent Management API
V. Comments for CVE-2026-73304
No comments yet