Description

Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve the identity-provider credentials of SSO-authenticated users and use the refresh tokens for persistent access to connected services. This issue is fixed in version 3.39.25.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-13T22:17:25.500Z",
  "pubdate": "2026-08-13T22:17:25.500Z",
  "executiveSummary": "Budibase versions prior to 3.39.25 suffer from an insecure direct object reference and sensitive data exposure vulnerability affecting the GET /api/users/metadata and GET /api/users/metadata/:id endpoints. The root cause stems from the processing of user objects via packages/server/src/utilities/global.ts without sanitizing or stripping sensitive authentication artifacts such as oauth2.accessToken and oauth2.refreshToken fields. An authenticated user possessing the POWER role can exploit this flaw to harvest the identity-provider credentials of SSO-authenticated users. The successful exploitation of this vulnerability compromises the confidentiality of connected external services, allowing malicious actors to hijack user sessions, leverage stolen refresh tokens for persistent unauthorized access, and execute lateral movement within integrated enterprise environments. Mitigation requires upgrading Budibase to version 3.39.25 or later, which correctly sanitizes user metadata responses to exclude sensitive OAuth2 tokens.",
  "technicalDetails": "The vulnerability resides in the backend API routing and data processing logic of Budibase, specifically impacting the GET /api/users/metadata and GET /api/users/metadata/:id endpoints. When these endpoints are queried, user objects are processed and serialized through packages/server/src/utilities/global.ts. Due to insufficient filtering and improper object sanitization, the application fails to redact internal security attributes associated with single sign-on (SSO) authentication mechanisms. Consequently, sensitive properties including oauth2.accessToken and oauth2.refreshToken are inadvertently exposed within the standard API JSON response payload.\nTo execute an attack, an adversary must possess authenticated access to the Budibase platform with at least the POWER role. The attacker submits an HTTP GET request to either the GET /api/users/metadata endpoint to enumerate metadata for multiple users or the GET /api/users/metadata/:id endpoint to target a specific user record. Upon processing the request, the server returns the unredacted user objects containing the cleartext or decipherable OAuth2 tokens belonging to SSO-authenticated users. \nFollowing token extraction, the attacker engages in post-exploitation activities by leveraging the stolen oauth2.refreshToken values. These refresh tokens can be used independently of the Budibase application to request new access tokens from external identity providers or connected third-party services. This grants the attacker persistent, out-of-band access to victim accounts and enterprise integrations, effectively bypassing session timeouts and multi-factor authentication controls enforced by the external services. The network exposure is constrained to the application's HTTP/HTTPS API interface, but the downstream impact extends across any integrated third-party ecosystem utilizing the exposed OAuth2 grants. The vulnerability is fully resolved in version 3.39.25 through the implementation of strict attribute filtering within the data serialization pipeline."
}