CVE-2026-50136: Budibase Unauthenticated S3 Presigned URL Generation Vulnerability

Technical summary

CVE-2026-50136 exploits an unauthenticated route in Budibase's application server that generates AWS S3 PutObject presigned URLs. The vulnerability stems from insufficient authorization enforcement (CWE-306) on an endpoint that should require authenticated access, table-level permissions, datasource permissions, or builder role validation. Instead, the route relies solely on CAPTCHA middleware for protection. An attacker who obtains or guesses a workspace ID and S3 datasource ID can request presigned URLs for attacker-controlled bucket and key paths, potentially leveraging legitimate AWS credentials stored in the workspace configuration to facilitate unauthorized uploads.

Business impact

Organizations running Budibase as a collaborative low-code development platform face exposure of their AWS S3 credentials and potential unauthorized data placement in cloud storage. An attacker could upload malicious files, overwrite legitimate objects, or inject data into S3 buckets used for application data or backups. This could lead to data integrity violations, deployment of compromised assets, or lateral movement if those buckets are integrated with downstream systems. The attack requires no privileged account, lowering the barrier for opportunistic exploitation.

Affected systems

Budibase versions prior to 3.39.3 are affected. Both self-hosted and cloud deployments are vulnerable if they are accessible over the network and have S3 datasources configured with active AWS credentials. The vulnerability affects the core application server and does not depend on specific extensions or optional features.

Exploitability

The attack is straightforward to execute: an attacker needs only to identify a Budibase workspace ID and associated S3 datasource ID, then send a crafted HTTP request to the vulnerable endpoint specifying target bucket and key values. No valid user account is required, and CAPTCHA alone provides minimal protection against automated exploitation. The vulnerability has a CVSS v3.1 score of 7.4 (HIGH) reflecting network accessibility, low attack complexity, and low privileges required, though the impact is moderate rather than critical due to the need for valid workspace/datasource enumeration.

Remediation

Upgrade Budibase to version 3.39.3 or later immediately. This release patches the authorization bypass by implementing proper authentication and permission checks on the presigned URL generation endpoint. Organizations should verify the upgrade is complete and monitor S3 buckets for unexpected activity during and after the patching window. Consider applying least-privilege IAM policies to the AWS credentials stored in Budibase, limiting S3 permissions to only required buckets and key prefixes.

Patch guidance

Apply Budibase version 3.39.3 or newer. Review your deployment method (Docker, self-hosted binary, cloud platform) and follow the vendor's upgrade documentation for your environment. Test the upgrade in a non-production environment first to ensure compatibility with custom integrations or workflows. After patching, confirm that presigned URL endpoints now properly validate authentication tokens and permission scopes.

Detection guidance

Monitor HTTP access logs for requests to endpoints that generate presigned URLs, particularly those lacking valid authentication headers or session cookies. Watch for repeated requests from external IPs with varying workspace or datasource ID parameters, which may indicate enumeration attempts. In AWS CloudTrail, look for unexpected calls to S3 PutObject operations originating from presigned URLs with unexpected key paths or bucket targets. Alert on any successful uploads to S3 that do not correlate with known Budibase workflow activity.

Why prioritize this

This vulnerability merits immediate attention because it requires no valid user credentials to exploit, can be attempted by any network-accessible instance, and directly exposes cloud storage write capabilities. While it does not appear on the CISA KEV list yet, the low barrier to exploitation and potential for data integrity violations make it a high-priority patch candidate, especially for organizations with sensitive data or intellectual property stored in S3.

Risk score, explained

The CVSS 7.4 (HIGH) score reflects a network-based attack requiring no special conditions (AC:L), low privilege requirements (PR:L—the PR:L value in the vector indicates the attack assumes some user context, though in practice authentication is bypassed), and multi-scope impact covering confidentiality, integrity, and availability. The score appropriately elevates this above medium severity due to the combination of ease of access and the leverage of legitimate AWS credentials for unauthorized object operations.

Frequently asked questions