An authenticated user with BASIC level permissions can invoke the /api/datasources/:datasourceId endpoint and receive the full Snowflake PEM private key in plaintext because the masking filter only excludes fields marked as PASSWORD. The privateKey field is labeled as SENSITIVE_LONGFORM, which is not processed by the existing filter. This flaw allows the accidental disclosure of highly sensitive credentials that could grant full access to the associated Snowflake account if compromised.

Budibase is affected for all releases prior to 3.38.3. The vulnerability exists in the server component of the platform where the GET /api/datasources/:datasourceId route is authorized by PermissionType.TABLE and PermissionLevel.READ, and allows BASIC users to read all datasource configurations.

The CVSS score of 7.7 indicates a high-severity vulnerability. Although the EPSS score is not available and the vulnerability is not listed in CISA KEV, the attack path is straightforward: an attacker only needs to be authenticated as a BASIC user. Because the endpoint is reachable from the frontend, the risk of exploitation is significant and the impact is irreversible once the private key is exposed.