Read the docs
TI-2026-51083 Aliases CVE-2026-72859GHSA-9pwj-99rm-cq6j

Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL

Priority HIGH 69CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users hold by default. Attackers can specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket accessible by the stored IAM credentials, enabling unauthorized file uploads.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00219 12th percentileScored 2026-11-07
Fix Fixed server (budibase): 3.40.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Budibaseserver3.39.4 to before 3.40.03.40.0Patch availableCNA
  • server VendorBudibase Affected 3.39.4 to before 3.40.0 Fixed in 3.40.0 Patch available CNA

Remediation

  • Fix · CNA server (budibase) Fixed in 3.40.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-72859
  2. 2026-10-03 Alias added: GHSA-9pwj-99rm-cq6j

References

Advisory 1

  • TI-2026-39242 Budibase: Anonymous NoSQL operator injection via published-app query templates CVSS 3.1CRITICAL 10.0
  • TI-2026-51076 Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook CVSS 4.0CRITICAL 9.0
  • TI-2026-24369 Budibase Universal Auth Bypass via Webhook Query Param Injection CVSS 3.1CRITICAL 9.1
  • TI-2026-56709 Budibase before 3.41.3 Remote Code Execution via Plugin eval() CVSS 4.0CRITICAL 9.4
  • TI-2026-51425 Budibase: SQL Injection via `multipleStatements: true` CVSS 3.1CRITICAL 9.6
  • TI-2026-51075 Budibase before 3.40.0 Arbitrary File Write via Path Traversal CVSS 4.0CRITICAL 9.4
See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences