CVE-2026-54356

Received Received - Intake

Authenticated S3 Bucket Access in Budibase

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-54356

EUVD

EUVD-2026-60382

Affected Vendors & Products

Vendor	Product	Version / Range
budibase	budibase	3.41.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Budibase versions before 3.41.3 allows an authenticated user with the BASIC role in a published app to manipulate S3 bucket and key values. By sending crafted requests to POST /api/attachments/:datasourceId/url, the attacker can obtain signed and public URLs that use stored S3 datasource credentials, potentially leading to unauthorized access to S3 resources.

Detection Guidance

Check Budibase server logs for unusual POST requests to /api/attachments/:datasourceId/url with unexpected bucket or key parameters. Monitor for unauthorized access to S3 credentials or signed URLs.

Impact Analysis

An attacker could exploit this to access or manipulate data in S3 buckets that the Budibase app is configured to use. This may result in data leaks, data corruption, or unauthorized modifications to stored files, depending on the permissions of the S3 datasource credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations using affected Budibase versions may face compliance violations, potential fines, and reputational damage due to data exposure or loss.

Mitigation Strategies

Upgrade Budibase to version 3.41.3 or later to patch the vulnerability.
Review and restrict access to published-app users with BASIC role to prevent unauthorized requests.
Audit S3 datasource credentials and revoke any potentially exposed credentials.

Hi! I’m here to help you understand CVE-2026-54356. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70