The vulnerability in @budibase/server affects versions before 3.39.25. The `/api/users/metadata` and `/api/users/metadata/:id` endpoints return full global user profiles to users with POWER role or above. For users authenticated via SSO (OIDC, Google), the OAuth2 tokens (`accessToken` and `refreshToken`) are stored in the global CouchDB user document but are not stripped from the API responses. The endpoints only remove `password` and `roles` fields but leave the `oauth2` field intact. This results in leakage of sensitive OAuth2 tokens to unauthorized users with POWER role, enabling potential misuse of identity provider credentials. The recommended fix involves explicitly deleting the `oauth2` and other SSO-related sensitive fields in the user processing function and adding defense-in-depth stripping in the raw user fetch function.

Users with POWER role in any Budibase app can access all SSO users' OAuth2 access and refresh tokens via the user metadata endpoints. This exposure allows unauthorized access to external identity provider resources (e.g., Google Workspace, Azure AD, Okta) as the victim user. Refresh tokens enable indefinite renewal of access, extending the window of compromise. Additionally, leakage of admin, builder, tenantId, ssoId, and userGroups fields reveals the full authorization topology of the instance, potentially aiding further attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The recommended fix is to modify the `processUser()` function to delete the `oauth2` and other SSO-related sensitive fields before returning user metadata. Additionally, the `getRawGlobalUsers()` function should also strip the `oauth2` field for defense in depth. Until a patch is available, restrict POWER role assignments to trusted users only and monitor for suspicious access patterns to user metadata endpoints.