GHSA-fcrw-f7gg-6g9f: Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users
(updated )
The /api/users/metadata and /api/users/metadata/:id endpoints in @budibase/server return full global user profiles to any user with POWER role or above. For SSO-authenticated users (OIDC, Google), the response includes oauth2.accessToken and oauth2.refreshToken fields, leaking identity provider credentials to other users who should not have access to them.
References
- github.com/Budibase/budibase/commit/7b8ba11a2c8b233c35e7728dd752dba25ef919a4
- github.com/Budibase/budibase/commit/80a31f6c3354620aa90e50af8a2c614333084621
- github.com/Budibase/budibase/pull/19110
- github.com/Budibase/budibase/releases/tag/3.39.25
- github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f
- github.com/advisories/GHSA-fcrw-f7gg-6g9f
- nvd.nist.gov/vuln/detail/CVE-2026-73304
Code Behaviors & Features
Detect and mitigate GHSA-fcrw-f7gg-6g9f with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →