GHSA-FCRW-F7GG-6G9F中危已审查

Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

OSV 1.4.0 · github-reviewed · 修改于 2026-08-13 02:57

发布时间

2026-07-25 05:14

GitHub 审查时间

2026-07-25 05:14

NVD 发布时间

—

源文件

advisories/github-reviewed/2026/07/GHSA-fcrw-f7gg-6g9f/GHSA-fcrw-f7gg-6g9f.json

公告说明

Summary

The /api/users/metadata and /api/users/metadata/:id endpoints in @budibase/server return full global user profiles to any user with POWER role or above. For SSO-authenticated users (OIDC, Google), the response includes oauth2.accessToken and oauth2.refreshToken fields, leaking identity provider credentials to other users who should not have access to them.

Details

When a user authenticates via SSO (OIDC or Google), the OAuth2 tokens are stored in the global CouchDB user document at packages/backend-core/src/auth/auth.ts:170-173:

dbUser.oauth2 = {
  ...dbUser.oauth2,
  ...details,
}
await db.put(dbUser)

The user metadata endpoints are protected by PermissionType.USER, PermissionLevel.READ (packages/server/src/api/routes/user.ts:11), which maps to the POWER permission set (packages/backend-core/src/security/permissions.ts:99).

Path 1 — List all users (GET /api/users/metadata):

controller.fetchMetadata → sdk.users.fetchMetadata() (packages/server/src/sdk/users/utils.ts:78)
→ getGlobalUsers() → getRawGlobalUsers() (packages/server/src/utilities/global.ts:101-122) — strips only password and forceResetPassword
→ processUser() (packages/server/src/utilities/global.ts:15-76) — strips only password and roles
The oauth2 field containing accessToken and refreshToken is never removed

Path 2 — Single user (GET /api/users/metadata/:id):

controller.findMetadata → getFullUser() (packages/server/src/utilities/users.ts:6)
→ getGlobalUser() → () — raw CouchDB fetch,

getRawGlobalUser()

packages/server/src/utilities/global.ts:90-92

no field stripping at all

→ processUser() — strips only password and roles

Same result: oauth2 tokens are returned

There is no output sanitization middleware on these routes that would strip sensitive fields before the response reaches the client.

Prerequisites: A Budibase instance with at least one SSO-authenticated user (OIDC or Google) and a separate user with POWER role in an app.

Step 1 — As the POWER user, list all users:

curl -s -X GET 'http://localhost:10000/api/users/metadata' \
  -H 'Cookie: budibase:auth=<power-user-jwt>' \
  -H 'x-budibase-app-id: app_<appid>' | jq '.[].oauth2'

Expected output: null for all users (tokens should not be exposed)

Actual output: For SSO users, the response includes:

{
  "accessToken": "ya29.a0ARrdaM...",
  "refreshToken": "1//0eXxXxXxXx..."
}

Step 2 — Fetch a specific SSO user's profile:

curl -s -X GET 'http://localhost:10000/api/users/metadata/ro_ta_users_us_<sso-user-id>' \
  -H 'Cookie: budibase:auth=<power-user-jwt>' \
  -H 'x-budibase-app-id: app_<appid>' | jq '.oauth2'

This also returns the full OAuth2 tokens.

A user with POWER role in any app can read all SSO users' OAuth2 access tokens and refresh tokens via the list endpoint, without needing to know individual user IDs.
Stolen access tokens can be used to access external identity provider resources (Google Workspace, Azure AD, Okta-protected services) as the victim user.
Refresh tokens allow indefinite token renewal, persisting access even after the original access token expires.
Additionally, admin, builder, tenantId, ssoId, and userGroups fields are leaked, revealing the full authorization topology of the instance.

Strip sensitive SSO fields in processUser() at packages/server/src/utilities/global.ts:15:

export async function processUser(
  user: ContextUser,
  opts: { appId?: string; groups?: UserGroup[] } = {}
) {
  if (!user || (!user.roles && !user.userGroups)) {
    return user
  }
  user = cloneDeep(user)
  delete user.password
+ delete (user as any).oauth2
+ delete (user as any).provider
+ delete (user as any).providerType
+ delete (user as any).thirdPartyProfile
+ delete (user as any).profile
+ delete (user as any).ssoId
+ delete (user as any).forceResetPassword
  // ... rest of function

Additionally, getRawGlobalUsers() at line 101 should also strip oauth2 alongside its existing password/forceResetPassword stripping for defense in depth.

受影响的软件包

npm

@budibase/server

ECOSYSTEM

引入0修复3.39.25

标识信息

别名 / CVE

CVE-2026-73304

CWE

CWE-200

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-fcrw-f7gg-6g9f",
  "aliases": [
    "CVE-2026-73304"
  ],
  "details": "## Summary\n\nThe `/api/users/metadata` and `/api/users/metadata/:id` endpoints in `@budibase/server` return full global user profiles to any user with POWER role or above. For SSO-authenticated users (OIDC, Google), the response includes `oauth2.accessToken` and `oauth2.refreshToken` fields, leaking identity provider credentials to other users who should not have access to them.\n\n## Details\n\nWhen a user authenticates via SSO (OIDC or Google), the OAuth2 tokens are stored in the global CouchDB user document at `packages/backend-core/src/auth/auth.ts:170-173`:\n\n```typescript\ndbUser.oauth2 = {\n  ...dbUser.oauth2,\n  ...details,\n}\nawait db.put(dbUser)\n```\n\nThe user metadata endpoints are protected by `PermissionType.USER, PermissionLevel.READ` (`packages/server/src/api/routes/user.ts:11`), which maps to the POWER permission set (`packages/backend-core/src/security/permissions.ts:99`).\n\n**Path 1 — List all users** (`GET /api/users/metadata`):\n1. `controller.fetchMetadata` → `sdk.users.fetchMetadata()` (`packages/server/src/sdk/users/utils.ts:78`)\n2. → `getGlobalUsers()` → `getRawGlobalUsers()` (`packages/server/src/utilities/global.ts:101-122`) — strips only `password` and `forceResetPassword`\n3. → `processUser()` (`packages/server/src/utilities/global.ts:15-76`) — strips only `password` and `roles`\n4. The `oauth2` field containing `accessToken` and `refreshToken` is **never removed**\n\n**Path 2 — Single user** (`GET /api/users/metadata/:id`):\n1. `controller.findMetadata` → `getFullUser()` (`packages/server/src/utilities/users.ts:6`)\n2. → `getGlobalUser()` → `getRawGlobalUser()` (`packages/server/src/utilities/global.ts:90-92`) — raw CouchDB fetch, **no field stripping at all**\n3. → `processUser()` — strips only `password` and `roles`\n4. Same result: `oauth2` tokens are returned\n\nThere is no output sanitization middleware on these routes that would strip sensitive fields before the response reaches the client.\n\n## PoC\n\n**Prerequisites:** A Budibase instance with at least one SSO-authenticated user (OIDC or Google) and a separate user with POWER role in an app.\n\n**Step 1 — As the POWER user, list all users:**\n```bash\ncurl -s -X GET 'http://localhost:10000/api/users/metadata' \\\n  -H 'Cookie: budibase:auth=<power-user-jwt>' \\\n  -H 'x-budibase-app-id: app_<appid>' | jq '.[].oauth2'\n```\n\n**Expected output:** `null` for all users (tokens should not be exposed)\n\n**Actual output:** For SSO users, the response includes:\n```json\n{\n  \"accessToken\": \"ya29.a0ARrdaM...\",\n  \"refreshToken\": \"1//0eXxXxXxXx...\"\n}\n```\n\n**Step 2 — Fetch a specific SSO user's profile:**\n```bash\ncurl -s -X GET 'http://localhost:10000/api/users/metadata/ro_ta_users_us_<sso-user-id>' \\\n  -H 'Cookie: budibase:auth=<power-user-jwt>' \\\n  -H 'x-budibase-app-id: app_<appid>' | jq '.oauth2'\n```\n\nThis also returns the full OAuth2 tokens.\n\n## Impact\n\n- A user with POWER role in any app can read **all SSO users' OAuth2 access tokens and refresh tokens** via the list endpoint, without needing to know individual user IDs.\n- Stolen access tokens can be used to access external identity provider resources (Google Workspace, Azure AD, Okta-protected services) as the victim user.\n- Refresh tokens allow indefinite token renewal, persisting access even after the original access token expires.\n- Additionally, `admin`, `builder`, `tenantId`, `ssoId`, and `userGroups` fields are leaked, revealing the full authorization topology of the instance.\n\n## Recommended Fix\n\nStrip sensitive SSO fields in `processUser()` at `packages/server/src/utilities/global.ts:15`:\n\n```typescript\nexport async function processUser(\n  user: ContextUser,\n  opts: { appId?: string; groups?: UserGroup[] } = {}\n) {\n  if (!user || (!user.roles && !user.userGroups)) {\n    return user\n  }\n  user = cloneDeep(user)\n  delete user.password\n+ delete (user as any).oauth2\n+ delete (user as any).provider\n+ delete (user as any).providerType\n+ delete (user as any).thirdPartyProfile\n+ delete (user as any).profile\n+ delete (user as any).ssoId\n+ delete (user as any).forceResetPassword\n  // ... rest of function\n```\n\nAdditionally, `getRawGlobalUsers()` at line 101 should also strip `oauth2` alongside its existing `password`/`forceResetPassword` stripping for defense in depth.",
  "summary": " Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.39.25"
            }
          ]
        }
      ],
      "package": {
        "name": "@budibase/server",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2026-08-12T18:57:12Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
  "published": "2026-07-24T21:14:31Z",
  "references": [
    {
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f",
      "type": "WEB"
    },
    {
      "url": "https://github.com/Budibase/budibase/pull/19110",
      "type": "WEB"
    },
    {
      "url": "https://github.com/Budibase/budibase/commit/7b8ba11a2c8b233c35e7728dd752dba25ef919a4",
      "type": "WEB"
    },
    {
      "url": "https://github.com/Budibase/budibase/commit/80a31f6c3354620aa90e50af8a2c614333084621",
      "type": "WEB"
    },
    {
      "url": "https://github.com/Budibase/budibase",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/Budibase/budibase/releases/tag/3.39.25",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2026-07-24T21:14:31Z"
  }
}