Server: Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs
Budibase server version 3.39.4 contains an authorization regression in the S3 presigned URL upload endpoint. This flaw allows BASIC app users, who normally have limited permissions, to obtain S3 PutObject presigned URLs. The endpoint incorrectly uses TABLE/WRITE permission instead of the intended BUILDER level, and does not restrict the target S3 bucket to the configured datasource bucket, enabling uploads to any S3 bucket accessible by the stored IAM credentials.
AI Analysis
Technical Summary
In Budibase v3.39.4, the API route /api/attachments/:datasourceId/url was changed from requiring BUILDER-level authorization to TABLE/WRITE permission, which BASIC users possess by default. This regression allows BASIC users to generate presigned S3 PutObject URLs. Additionally, the controller accepts a bucket parameter from the request body without validating it against the datasource's configured bucket, permitting uploads to arbitrary S3 buckets within the IAM credential scope. The issue was confirmed by tests authenticating as BASIC users successfully obtaining signed URLs. The root cause is the lowered authorization requirement combined with lack of bucket validation.
Potential Impact
An attacker with BASIC app user privileges can generate valid presigned S3 PutObject URLs and upload arbitrary content to any S3 bucket accessible by the IAM credentials stored in the application. This could lead to unauthorized data injection or modification in S3 buckets, potentially impacting data integrity and security. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
A fix is available by restoring the authorization middleware to require BUILDER-level permissions on the affected endpoint. Additionally, the implementation should validate that the datasourceId belongs to the caller's app and enforce that the S3 bucket used for presigned URLs matches the configured datasource bucket, ignoring any caller-supplied bucket parameter. Since no official patch link is provided, check the Budibase vendor advisory or upcoming releases for the official fix.
Server: Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs
Description
Budibase server version 3.39.4 contains an authorization regression in the S3 presigned URL upload endpoint. This flaw allows BASIC app users, who normally have limited permissions, to obtain S3 PutObject presigned URLs. The endpoint incorrectly uses TABLE/WRITE permission instead of the intended BUILDER level, and does not restrict the target S3 bucket to the configured datasource bucket, enabling uploads to any S3 bucket accessible by the stored IAM credentials.
CVSS v3.1
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Budibase v3.39.4, the API route /api/attachments/:datasourceId/url was changed from requiring BUILDER-level authorization to TABLE/WRITE permission, which BASIC users possess by default. This regression allows BASIC users to generate presigned S3 PutObject URLs. Additionally, the controller accepts a bucket parameter from the request body without validating it against the datasource's configured bucket, permitting uploads to arbitrary S3 buckets within the IAM credential scope. The issue was confirmed by tests authenticating as BASIC users successfully obtaining signed URLs. The root cause is the lowered authorization requirement combined with lack of bucket validation.
Potential Impact
An attacker with BASIC app user privileges can generate valid presigned S3 PutObject URLs and upload arbitrary content to any S3 bucket accessible by the IAM credentials stored in the application. This could lead to unauthorized data injection or modification in S3 buckets, potentially impacting data integrity and security. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
A fix is available by restoring the authorization middleware to require BUILDER-level permissions on the affected endpoint. Additionally, the implementation should validate that the datasourceId belongs to the caller's app and enforce that the S3 bucket used for presigned URLs matches the configured datasource bucket, ignoring any caller-supplied bucket parameter. Since no official patch link is provided, check the Budibase vendor advisory or upcoming releases for the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-xcx6-4f2g-hhgx
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a65422e9c2644c7f808a610
Added to database: 07/25/2026, 23:09:34 UTC
Last enriched: 07/25/2026, 23:57:18 UTC
Last updated: 07/26/2026, 03:58:20 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.