CVE-2026-72859
Received Received - Intake

Authorization Bypass in Budibase S3 Attachment Upload

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users hold by default. Attackers can specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket accessible by the stored IAM credentials, enabling unauthorized file uploads.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-72859
EUVD
EUVD-2026-58653

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
budibase budibase From 3.39.4 (inc) to 3.40.0 (exc)
budibase budibase From 3.39.4 (inc) to 3.39.9 (inc)
budibase budibase to 3.40.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization regression in Budibase versions 3.39.4 to 3.39.9. It allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The issue occurs because the permission check was changed from BUILDER to TABLE/WRITE, which BASIC users have by default. Attackers can specify arbitrary S3 buckets to generate presigned URLs for writing to any accessible bucket using stored IAM credentials.

Detection Guidance

Check Budibase server logs for POST requests to /api/attachments/<datasourceId>/url from BASIC users. Monitor S3 access logs for unexpected PutObject operations from Budibase IAM credentials. Use network traffic analysis to detect presigned URL generation requests.

Impact Analysis

This vulnerability enables unauthorized file uploads to any S3 bucket accessible by the application's IAM credentials. Attackers with BASIC user access can upload arbitrary content, potentially leading to data breaches, data integrity issues, or unauthorized modifications to stored files. The impact includes compromised data confidentiality and integrity.

Compliance Impact

This vulnerability can lead to non-compliance with GDPR and HIPAA due to unauthorized data access and potential data breaches. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Unauthorized file uploads could expose sensitive data, violating these regulations and resulting in legal penalties or loss of certification.

Mitigation Strategies

Upgrade Budibase to version 3.40.0 or later. Temporarily restrict BASIC user permissions until patching. Review S3 bucket access policies for Budibase IAM credentials to limit write permissions. Monitor for unauthorized uploads during the transition period.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72859. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart