Executive brief
Budibase, a low-code application development platform, contains a flaw in its file attachment API that allows low-privilege users to generate arbitrary AWS S3 upload URLs using the server's stored cloud credentials. An attacker with basic app access could craft requests to upload files to any S3 bucket and location that the server has permission to write to, enabling data injection, malware distribution, or service disruption through cloud storage compromise.
Technical details
The vulnerability is a missing authorization check (CWE-862) in Budibase's attachment API endpoint. The endpoint at POST /api/attachments/:datasourceId/url is intended to generate pre-signed S3 upload URLs, but fails to properly restrict which buckets and object keys low-privilege users can target. An authenticated user with the built-in BASIC role on a published app can send a request with attacker-controlled bucket and key parameters to the endpoint, which returns a valid AWS signature valid for 900 seconds. The authorization middleware (authorized.ts, resourceId.ts) does not enforce appropriate scope limits, allowing lateral privilege escalation from development-context restrictions (which correctly return 403) to published-app context. The datasource credentials are fetched server-side and used to sign the URLs, enabling the attacker to abuse production cloud infrastructure permissions. No patch has been released as of the advisory date.
Affected products
- Budibase @budibase/server <= 3.38.1
Timeline
- 2026-08-26: disclosed: GitHub Advisory published
- 2026-08-14: advisory: Reviewed by GitHub
- 2026-08-17: other: Published to NVD
- 2026-03-41: other: Patch released in version 3.41.3