{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.38.1"}],"component":"@budibase/server","cve_ids":["CVE-2026-73308"],"ecosystem":"npm","epss":0.00407,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-gh4h-34gr-87r7","id":"tcs_01M5KFRQPJRQWERBRR16N0D51S","modified_at":"2026-08-12T19:26:07.589128Z","published_at":"2026-07-24T21:25:20Z","references":["https://osv.dev/vulnerability/GHSA-gh4h-34gr-87r7","https://github.com/Budibase/budibase/security/advisories/GHSA-gh4h-34gr-87r7","https://github.com/Budibase/budibase/pull/19107","https://github.com/Budibase/budibase/commit/bca426de7dc36d680285295655dc640dea2aab21","https://github.com/Budibase/budibase","https://github.com/Budibase/budibase/releases/tag/3.39.25"],"severity":{"label":"medium","score":5.7},"sources":[{"source":"osv","source_id":"GHSA-gh4h-34gr-87r7","url":"https://osv.dev/vulnerability/GHSA-gh4h-34gr-87r7"}],"summary":"Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders"}