The vulnerability lies in the GET /api/users/metadata and GET /api/users/metadata/:id endpoints of Budibase, which return user objects that still contain oauth2.accessToken and oauth2.refreshToken fields. A user with the POWER role can retrieve these broker-level credentials for SSO‑authenticated users. Those tokens allow the attacker to obtain persistent access to connected services, effectively exposing the confidentiality of OAuth credentials. This flaw is categorized as CWE‑200.

Budibase, version 3.39.x and earlier, uses the packages/server/src/utilities/global.ts code path. Any deployment prior to the 3.39.25 release is affected.

The CVSS score of 4.9 indicates moderate vulnerability severity. EPSS is not available, and the flaw is not listed in CISA KEV. The attack vector requires a user who already has POWER role privileges, so exploitation is limited to compromised or mis‑role‑assigned accounts. While the impact is significant in terms of credential leakage, the risk is primarily confined to the level of the attacker’s existing privileges.