CVE-2026-73304

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.25

Description An issue exists where the endpoints 'GET /api/users/metadata' and 'GET /api/users/metadata/:id' return user objects processed by the packages/server/src/utilities/global.ts file without removing the oauth2.accessToken and oauth2.refreshToken variables. A user assigned the POWER role can retrieve identity-provider credentials of users authenticated via Single Sign-On (SSO), potentially using refresh tokens to maintain persistent access to connected services.

Recommendations Update to version 3.39.25.