Budibase versions prior to 3.39.0 expose the OAuth2 token fetch function to SSRF attacks because the code uses raw fetch calls without the recommended fetchWithBlacklist protection. A user who has the BUILDER role can configure the OAuth2 token URL to point to internal services such as CouchDB or cloud metadata endpoints. When the platform later requests the token, the request is sent from the Budibase server to the specified internal service, allowing the attacker to read sensitive configuration data or other internal resources.

The affected product is Budibase itself. All deployments running any version earlier than 3.39.0 are vulnerable. The vulnerability specifically impacts users who can modify OAuth2 configuration and have the BUILDER role authorization.

The CVSS score of 7.7 indicates a high severity vulnerability. Although the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, the potential for internal data theft remains significant. The likely attack vector is a legitimate client with BUILDER privileges who configures a malicious OAuth2 token URL; the vulnerability does not require external network access beyond normal operation of the Budibase instance, but it can be leveraged to exfiltrate internal data from the environment where Budibase is hosted.