CVE-2026-50136
CVE-2026-50136 · Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require authentication, table permission, datasource permission, or builder access. A public caller who knows a workspace ID and S3 datasource ID can request a signed upload URL for attacker-controlled bucket and key values. This vulnerability is fixed in 3.39.3.
CVSS 7.4 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
budibase
- Versions
- < 3.39.3: Affected
No fix published
@budibase/server npm
- Affected ranges
- SEMVER: < 3.39.2
Update to 3.39.2