Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

CIRCL OSINT Feed

Threatpost

ThreatFox MISP Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

@budibase/server

## Summary

The `/api/users/metadata` and `/api/users/metadata/:id` endpoints in `@budibase/server` return full global user profiles to any user with POWER role or above. For SSO-authenticated users (OIDC, Google), the response includes `oauth2.accessToken` and `oauth2.refreshToken` fields, leaking identity provider credentials to other users who should not have access to them.

## Details

When a user authenticates via SSO (OIDC or Google), the OAuth2 tokens are stored in the global CouchDB user document at `packages/backend-core/src/auth/auth.ts:170-173`:

```typescript
dbUser.oauth2 = {
  ...dbUser.oauth2,
  ...details,
}
await db.put(dbUser)
```

The user metadata endpoints are protected by `PermissionType.USER, PermissionLevel.READ` (`packages/server/src/api/routes/user.ts:11`), which maps to the POWER permission set (`packages/backend-core/src/security/permissions.ts:99`).

**Path 1 — List all users** (`GET /api/users/metadata`):
1. `controller.fetchMetadata` → `sdk.users.fetchMetadata()` (`packages/server/src/sdk/users/utils.ts:78`)
2. → `getGlobalUsers()` → `getRawGlobalUsers()` (`packages/server/src/utilities/global.ts:101-122`) — strips only `password` and `forceResetPassword`
3. → `processUser()` (`packages/server/src/utilities/global.ts:15-76`) — strips only `password` and `roles`
4. The `oauth2` field containing `accessToken` and `refreshToken` is **never removed**

**Path 2 — Single user** (`GET /api/users/metadata/:id`):
1. `controller.findMetadata` → `getFullUser()` (`packages/server/src/utilities/users.ts:6`)
2. → `getGlobalUser()` → `getRawGlobalUser()` (`packages/server/src/utilities/global.ts:90-92`) — raw CouchDB fetch, **no field stripping at all**
3. → `processUser()` — strips only `password` and `roles`
4. Same result: `oauth2` tokens are returned

There is no output sanitization middleware on these routes that would strip sensitive fields before the response reaches the client.

## PoC

**Prerequisites:** A Budibase instance with at least one SSO-authenticated user (OIDC or Google) and a separate user with POWER role in an app.

**Step 1 — As the POWER user, list all users:**
```bash
curl -s -X GET 'http://localhost:10000/api/users/metadata' \
  -H 'Cookie: budibase:auth=<power-user-jwt>' \
  -H 'x-budibase-app-id: app_<appid>' | jq '.[].oauth2'
```

**Expected output:** `null` for all users (tokens should not be exposed)

**Actual output:** For SSO users, the response includes:
```json
{
  "accessToken": "ya29.a0ARrdaM...",
  "refreshToken": "1//0eXxXxXxXx..."
}
```

**Step 2 — Fetch a specific SSO user's profile:**
```bash
curl -s -X GET 'http://localhost:10000/api/users/metadata/ro_ta_users_us_<sso-user-id>' \
  -H 'Cookie: budibase:auth=<power-user-jwt>' \
  -H 'x-budibase-app-id: app_<appid>' | jq '.oauth2'
```

This also returns the full OAuth2 tokens.

## Impact

- A user with POWER role in any app can read **all SSO users' OAuth2 access tokens and refresh tokens** via the list endpoint, without needing to know individual user IDs.
- Stolen access tokens can be used to access external identity provider resources (Google Workspace, Azure AD, Okta-protected services) as the victim user.
- Refresh tokens allow indefinite token renewal, persisting access even after the original access token expires.
- Additionally, `admin`, `builder`, `tenantId`, `ssoId`, and `userGroups` fields are leaked, revealing the full authorization topology of the instance.

## Recommended Fix

Strip sensitive SSO fields in `processUser()` at `packages/server/src/utilities/global.ts:15`:

```typescript
export async function processUser(
  user: ContextUser,
  opts: { appId?: string; groups?: UserGroup[] } = {}
) {
  if (!user || (!user.roles && !user.userGroups)) {
    return user
  }
  user = cloneDeep(user)
  delete user.password
+ delete (user as any).oauth2
+ delete (user as any).provider
+ delete (user as any).providerType
+ delete (user as any).thirdPartyProfile
+ delete (user as any).profile
+ delete (user as any).ssoId
+ delete (user as any).forceResetPassword
  // ... rest of function
```

Additionally, `getRawGlobalUsers()` at line 101 should also strip `oauth2` alongside its existing `password`/`forceResetPassword` stripping for defense in depth.

The vulnerability in @budibase/server affects versions before 3.39.25. The `/api/users/metadata` and `/api/users/metadata/:id` endpoints return full global user profiles to users with POWER role or above. For users authenticated via SSO (OIDC, Google), the OAuth2 tokens (`accessToken` and `refreshToken`) are stored in the global CouchDB user document but are not stripped from the API responses. The endpoints only remove `password` and `roles` fields but leave the `oauth2` field intact. This results in leakage of sensitive OAuth2 tokens to unauthorized users with POWER role, enabling potential misuse of identity provider credentials. The recommended fix involves explicitly deleting the `oauth2` and other SSO-related sensitive fields in the user processing function and adding defense-in-depth stripping in the raw user fetch function.

Detailed information about Server: Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users affecting null @budibase/server. Get real-

Server: Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users - Live Threat Intelligence - Threat Radar | OffSeq.com

Server: Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users (CVE-2026-73304)

Threats Tagged 'ghsa-fcrw-f7gg-6g9f'