CVE-2026-73304 Budibase CVE debrief

Who should care

Defenders managing Budibase instances, especially those with user roles like POWER, should assess exposure and prioritize remediation to prevent unauthorized access to connected services.

Why it matters

CVE-2026-73304 is a medium-severity vulnerability in Budibase that allows users with the POWER role to retrieve sensitive credentials of SSO-authenticated users. Defenders should verify exposure, prioritize upgrading to version 3.39.25, and review access controls to prevent unauthorized access to connected services.

• Potential unauthorized access to connected services through exposed refresh tokens.
• Elevation of privileges for users with the POWER role.
• Data breaches due to compromised SSO authentication credentials.
• Need for immediate version upgrade and access control review.

Technical summary

Budibase, an open-source low-code platform, had a vulnerability where users with the POWER role could retrieve identity-provider credentials of SSO-authenticated users. This was due to GET /api/users/metadata and GET /api/users/metadata/:id returning user objects processed without removing oauth2.accessToken or oauth2.refreshToken. The issue is fixed in version 3.39.25. The vulnerability could allow for persistent access to connected services through refresh tokens. Defenders should verify exposure of Budibase instances to untrusted users, especially those with the POWER role, and ensure immediate upgrade to version 3.39.25 or later. The fix involves updating the user object processing to remove sensitive oauth

Defensive priority

Defenders should prioritize verifying exposure of Budibase instances to untrusted users, especially those with the POWER role, and ensure immediate upgrade to version 3.39.25 or later.

Recommended defensive actions

• Verify Budibase instance exposure to untrusted users, especially those with the POWER role.
• Immediately upgrade to Budibase version 3.39.25 or later.
• Review and adjust access controls for Budibase users and roles.
• Monitor for suspicious activity related to SSO authentication and connected services.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, specific details about affected deployments, exploitation attempts, or actual data breaches are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.