CVE-2026-73308 in Budibase
Summary
by MITRE • 08/12/2026
Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.user.oauth2, broadcast BuilderSocketEvent.AutomationTestProgress to the app room, and stored progress in packages/server/src/automations/testProgress.ts without user scoping. A co-builder could receive or poll another SSO-authenticated builder test and obtain OAuth2 access and refresh tokens. The fix adds sanitizeAutomationTestResult and isolates progress by user. This issue is fixed in version 3.39.25.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability resides within Budibase's automation testing functionality, where a critical security flaw existed in versions prior to 3.39.25. The core issue stems from improper isolation of automation test results and their associated OAuth2 credentials within the server-side implementation. When automation tests were executed, the system returned detailed trigger outputs including user-specific OAuth2 information through the automation.ts controller file, creating a direct pathway for unauthorized access to sensitive authentication tokens.
The vulnerability exploited a fundamental lack of user scoping in the system's architecture, where test progress data was stored in testProgress.ts without proper isolation mechanisms. This design flaw allowed any co-builder within the same application room to receive or poll automation test progress updates from other SSO-authenticated users. The broadcast mechanism using BuilderSocketEvent.AutomationTestProgress served as the attack vector, enabling unauthorized information disclosure through the WebSocket communication layer.
This security gap directly maps to CWE-284 (Improper Access Control) and CWE-352 (Cross-Site Request Forgery) categories within the Common Weakness Enumeration framework. The vulnerability represents a privilege escalation scenario where a less-privileged user could access another user's OAuth2 tokens, potentially allowing them to impersonate that user and gain unauthorized access to connected services and applications. The ATT&CK framework categorizes this under T1566 (Phishing) and T1078 (Valid Accounts) as it enables credential theft and unauthorized access through legitimate authentication mechanisms.
The operational impact of this vulnerability extends beyond simple information disclosure, as OAuth2 tokens represent highly sensitive credentials that could be used to access third-party services integrated with the platform. An attacker could leverage these tokens to perform actions on behalf of authenticated users, potentially leading to data breaches, unauthorized service access, and further lateral movement within the affected environment. The continuous polling mechanism described in the vulnerability allowed for sustained access to test progress information, making it particularly dangerous for long-running automation tests.
The fix implemented in version 3.39.25 addresses these issues through multiple defensive measures including the introduction of sanitizeAutomationTestResult function that properly filters sensitive data before transmission and isolation of test progress data by user context. This approach ensures that each user's automation test progress remains private and accessible only to the authenticated user who initiated the test, effectively implementing proper access controls and information flow protection as recommended in security best practices.
The remediation aligns with security principles outlined in NIST Special Publication 800-53 and ISO/IEC 27001 standards, particularly focusing on access control mechanisms and data protection requirements. The solution demonstrates proper separation of concerns by ensuring that automation test results maintain user context integrity while preserving the platform's functionality for legitimate use cases. This vulnerability highlights the importance of implementing proper user scoping and privilege separation in multi-user collaborative environments where sensitive authentication information is processed and transmitted through shared communication channels.
Organizations using Budibase should immediately upgrade to version 3.39.25 or later to mitigate this risk, as the vulnerability could have enabled attackers to gain unauthorized access to connected services through stolen OAuth2 tokens. The fix ensures that each user's automation test progress remains isolated while maintaining the platform's core functionality for legitimate collaborative development workflows within the low-code environment.