https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 06:56:24 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-73304 <p>Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve the identity-provider credentials of SSO-authenticated users and use the refresh tokens for persistent access to connected services. This issue is fixed in version 3.39.25.</p> <p>Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve the identity-provider credentials of SSO-authenticated users and use the refresh tokens for persistent access to connected services. This issue is fixed in version 3.39.25.</p> https://db.gcve.eu/vuln/fkie_cve-2026-73304 https://db.gcve.eu/vuln/ghsa-fcrw-f7gg-6g9f <p><strong>Affected:</strong> npm: @budibase/server</p> <p>## Summary</p> <p>The `/api/users/metadata` and `/api/users/metadata/:id` endpoints in `@budibase/server` return full global user profiles to any user with POWER role or above. For SSO-authenticated users (OIDC, Google), the response includes `oauth2.accessToken` and `oauth2.refreshToken` fields, leaking identity provider credentials to other users who should not have access to them.</p> <p>## Details</p> <p>When a user authenticates via SSO (OIDC or Google), the OAuth2 tokens are stored in the global CouchDB user document at `packages/backend-core/src/auth/auth.ts:170-173`:</p> <p>```typescript dbUser.oauth2 = { ...dbUser.oauth2, ...details, } await db.put(dbUser) ```</p> <p>The user metadata endpoints are protected by `PermissionType.USER, PermissionLevel.READ` (`packages/server/src/api/routes/user.ts:11`), which maps to the POWER permission set (`packages/backend-core/src/security/permissions.ts:99`).</p> <p>**Path 1 — List all users** (`GET /api/users/metadata`): 1. `controller.fetchMetadata` → `sdk.users.fetchMetadata()` (`packages/server/src/sdk/users/utils.ts:78`) 2. → `getGlobalUsers()` → `getRawGlobalUsers()` (`packages/server/src/utilities/global.ts:101-122`) — strips only `password` and `forceResetPassword` 3. → `processUser()` (`packages/server/src/utilities/global.ts:15-76`) — strips only `password` and `roles` 4. The `oauth2` field containing `accessToken` and `refreshToken` is **never removed**</p> <p>**Path 2 — Single user** (`GET /api/users/metadata/:id`): 1. `controller.findMetadata` → `getFull…</p> <p><strong>Affected:</strong> npm: @budibase/server</p> <p>## Summary</p> <p>The `/api/users/metadata` and `/api/users/metadata/:id` endpoints in `@budibase/server` return full global user profiles to any user with POWER role or above. For SSO-authenticated users (OIDC, Google), the response includes `oauth2.accessToken` and `oauth2.refreshToken` fields, leaking identity provider credentials to other users who should not have access to them.</p> <p>## Details</p> <p>When a user authenticates via SSO (OIDC or Google), the OAuth2 tokens are stored in the global CouchDB user document at `packages/backend-core/src/auth/auth.ts:170-173`:</p> <p>```typescript dbUser.oauth2 = { ...dbUser.oauth2, ...details, } await db.put(dbUser) ```</p> <p>The user metadata endpoints are protected by `PermissionType.USER, PermissionLevel.READ` (`packages/server/src/api/routes/user.ts:11`), which maps to the POWER permission set (`packages/backend-core/src/security/permissions.ts:99`).</p> <p>**Path 1 — List all users** (`GET /api/users/metadata`): 1. `controller.fetchMetadata` → `sdk.users.fetchMetadata()` (`packages/server/src/sdk/users/utils.ts:78`) 2. → `getGlobalUsers()` → `getRawGlobalUsers()` (`packages/server/src/utilities/global.ts:101-122`) — strips only `password` and `forceResetPassword` 3. → `processUser()` (`packages/server/src/utilities/global.ts:15-76`) — strips only `password` and `roles` 4. The `oauth2` field containing `accessToken` and `refreshToken` is **never removed**</p> <p>**Path 2 — Single user** (`GET /api/users/metadata/:id`): 1. `controller.findMetadata` → `getFull…</p> https://db.gcve.eu/vuln/ghsa-fcrw-f7gg-6g9f