Description

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users hold by default. Attackers can specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket accessible by the stored IAM credentials, enabling unauthorized file uploads.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-14T12:16:47.440Z",
  "pubdate": "2026-08-14T12:16:47.440Z",
  "executiveSummary": "Budibase versions 3.39.4 prior to 3.40.0 suffer from an authorization regression vulnerability located within the S3 attachment upload endpoint.\nThe flaw stems from an improperly implemented access control check, transitioning a required BUILDER permission validation down to a TABLE/WRITE permission check.\nBecause BASIC users retain TABLE/WRITE privileges by default, unprivileged or low-privileged actors can exploit this regression to interact with the S3 attachment generation mechanism.\nAn attacker can supply arbitrary S3 bucket identifiers within the body of a POST request sent to the attachments endpoint, forcing the application to generate legitimate AWS S3 PutObject presigned URLs.\nThis allows unauthorized generation of write-access URLs for any S3 bucket accessible via the IAM credentials configured in the underlying environment, facilitating arbitrary file uploads.\nThe risk implication is high, as it exposes cloud storage resources to unauthorized data injection, potential data tampering, and supply chain or application integrity compromises without requiring high-level administrative privileges.",
  "technicalDetails": "The vulnerability resides in the S3 attachment upload endpoint of Budibase, specifically affecting versions 3.39.4 up to, but not including, version 3.40.0.\nThe root cause of the vulnerability is an authorization regression introduced during route handling modifications. Originally, the endpoint enforced a BUILDER permission check, restricting sensitive S3 presigned URL generation functions to users with application building capabilities.\nDuring development changes, this access control validation was relaxed to a TABLE/WRITE permission check.\nIn the default RBAC configuration of Budibase, BASIC users inherently possess TABLE/WRITE privileges, bypassing the intended security boundary intended for administrative or builder-level workflows.\nExploitation of this vulnerability requires network access to the Budibase instance and a valid session holding BASIC user privileges.\nThe attack flow proceeds as follows: First, an authenticated attacker with BASIC privileges crafts an HTTP POST request targeting the vulnerable S3 attachment upload endpoint.\nSecond, within the JSON payload or request body, the attacker specifies arbitrary S3 bucket names rather than the intended application-scoped buckets.\nThird, the application processes the POST request using the relaxed TABLE/WRITE authorization check. Finding the user authorized, the server leverages its stored AWS IAM credentials to generate and return a valid S3 PutObject presigned URL.\nFourth, utilizing the acquired presigned URL, the attacker can execute direct PUT requests against the targeted S3 buckets, bypassing application logic to upload arbitrary files.\nPost-exploitation impact includes unauthorized file placement in arbitrary S3 buckets reachable by the application's IAM role, which may lead to stored cross-site scripting if malicious files are served back to users, resource exhaustion, or the overwriting of critical cloud assets depending on the permission scope of the underlying AWS IAM credentials."
}