EUVD-2026-354881

fkie_cve-2026-54356

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.

GHSA-6x9p-4r67-5gjx — Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Affected: npm: @budibase/server

### Summary Budibase 3.39.7 allows a low-privilege authenticated published-app user with the built-in BASIC role to obtain arbitrary S3 pre-signed upload URLs backed by a workspace datasource's stored server-side credentials.

The affected endpoint is:

`POST /api/attachments/:datasourceId/url`

The caller can control: ```text bucket key ``` and receives: ```text signedUrl publicUrl ```

This lets a low-privilege published-app user mint S3 `PUT` URLs using server-side datasource credentials for attacker-chosen object destinations.

Steps:

1. Log in as an admin user. 2. Create a new app/workspace. 3. In the development app context, create an S3 datasource with valid credentials. 4. Publish the app. 5. Create a low-privilege user with the built-in BASIC role on the published production app ID. 6. Log in as that BASIC user. 7. Send: `POST /api/attachments/<datasourceId>/url`

with: ```json {"bucket":"foo","key":"bar"} ``` and the published app header: ```text x-budibase-app-id: <published_app_id> ``` Observe a successful response containing: ```text signedUrl publicUrl ```

### Observed result

The following behavior:

dev BASIC request: 403 User does not have permission app publish: SUCCESS prod BASIC request: 200 OK Example confirmed runtime values from the final successful run: ```text prodAppId: app_e6b4cdc6cd6949969a83ff11eee88c5a datasourceId: datasource_0cec491b26a742468257c62382aa3284 publicUrl: https://foo.s3.eu-west-1.amazonaws.com/bar ``` The returned signedUrl cont…

WID-SEC-W-2026-2849 — Budibase: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um Dateien zu manipulieren, vertrauliche Daten offenzulegen, erweiterte Berechtigungen zu erlangen und Sicherheitsmaßnahmen zu umgehen.

Most recent entries from all

EUVD-2026-354881

fkie_cve-2026-54356

GHSA-6x9p-4r67-5gjx — Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

WID-SEC-W-2026-2849 — Budibase: Mehrere Schwachstellen