Read the docs
TI-2026-36907 Aliases CVE-2026-50136GHSA-jj36-r9w3-3pfh

Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials

Priority HIGH 66CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.

Summary

Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require authentication, table permission, datasource permission, or builder access. A public caller who knows a workspace ID and S3 datasource ID can request a signed upload URL for attacker-controlled bucket and key values. This vulnerability is fixed in 3.39.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0029 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed budibase (Budibase): 3.39.3@budibase/server (npm): 3.39.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Budibasebudibasebefore 3.39.33.39.3Patch availableCNA
—@budibase/server (npm)before 3.39.23.39.2Patch availableGHSA-jj36-r9w3-3pfh
  • budibase VendorBudibase Affected before 3.39.3 Fixed in 3.39.3 Patch available CNA
  • @budibase/server (npm) Vendor— Affected before 3.39.2 Fixed in 3.39.2 Patch available GHSA-jj36-r9w3-3pfh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*before 3.39.3VulnerableBudibase
  • cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:* Versions before 3.39.3 Vulnerable ·Budibase

Remediation

  • Fix · CNA budibase (Budibase) Fixed in 3.39.3
  • Fix · GHSA-jj36-r9w3-3pfh @budibase/server (npm) Fixed in 3.39.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50136
  2. 2026-10-03 Alias added: GHSA-jj36-r9w3-3pfh

References

Exploit 1

Advisory 1

Other 3

  • TI-2026-39242 Budibase: Anonymous NoSQL operator injection via published-app query templates CVSS 3.1CRITICAL 10.0
  • TI-2026-24369 Budibase Universal Auth Bypass via Webhook Query Param Injection CVSS 3.1CRITICAL 9.1
  • TI-2026-39244 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload CVSS 3.1CRITICAL 9.6
  • TI-2026-39243 Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override CVSS 3.1CRITICAL 9.6
  • TI-2026-24371 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist CVSS 3.1CRITICAL 9.9
  • TI-2026-23473 Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets CVSS 3.1CRITICAL 9.6
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences