Description

Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.user.oauth2, broadcast BuilderSocketEvent.AutomationTestProgress to the app room, and stored progress in packages/server/src/automations/testProgress.ts without user scoping. A co-builder could receive or poll another SSO-authenticated builder test and obtain OAuth2 access and refresh tokens. The fix adds sanitizeAutomationTestResult and isolates progress by user. This issue is fixed in version 3.39.25.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.7",
  "pubDate": "2026-08-12T20:17:54.563Z",
  "pubdate": "2026-08-12T20:17:54.563Z",
  "executiveSummary": "A security vulnerability exists in the Budibase open-source low-code platform prior to version 3.39.25, specifically within the automation testing and progress tracking mechanism. The flaw involves the insecure exposure and storage of automation test results containing sensitive authentication material, specifically trigger.outputs.user.oauth2 data.\nThe vulnerability allows a co-builder with access to the same application to intercept or poll another SSO-authenticated builder's automation test results.\nBy capturing these payloads, an unauthorized co-builder can extract valid OAuth2 access tokens and refresh tokens. This compromises the confidentiality and integrity of the affected user sessions and connected third-party services.\nThe vulnerability stems from insufficient data sanitization in the automation controller and a lack of proper user-scoping in progress storage, enabling lateral privilege abuse among collaborative application builders without requiring administrative privileges.",
  "technicalDetails": "The vulnerability resides in the backend server implementation of Budibase, specifically within packages/server/src/api/controllers/automation.ts and packages/server/src/automations/testProgress.ts.\nRoot Cause: The automation test execution logic improperly handles sensitive runtime variables within the trigger output. Specifically, automation test results returned to the client and broadcasted over WebSocket channels included the trigger.outputs.user.oauth2 object. Furthermore, progress states associated with automation tests were stored globally in testProgress.ts without proper user-scoping or isolation.\nVulnerable Components: packages/server/src/api/controllers/automation.ts, BuilderSocketEvent.AutomationTestProgress, and packages/server/src/automations/testProgress.ts.\nAffected Versions: Budibase prior to version 3.39.25.\nAuthentication and Privilege Requirements: The attack requires access to the platform as a co-builder within the same workspace or application context. No administrative privileges are required.\nAttack Flow and Exploitation Method: 1. An SSO-authenticated builder initiates an automation test within the Budibase platform. 2. The automation execution generates test results containing sensitive authentication data, including user OAuth2 access and refresh tokens present in trigger.outputs.user.oauth2. 3. The server broadcasts these results via BuilderSocketEvent.AutomationTestProgress to the application room and writes the un-scoped progress data to the test progress storage mechanism. 4. A malicious or opportunistic co-builder listening to the broadcast channel or actively polling the test progress endpoint can intercept or retrieve the sensitive execution results. 5. The attacker extracts the exposed OAuth2 access and refresh tokens, enabling unauthorized access to downstream resources and services authenticated under the victim builder's identity."
}