Is CVE-2026-72859 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-72859 being exploited in the wild.

How severe is CVE-2026-72859?

High severity, with a CVSS score of 7.7, published 14 August 2026.

Which products and versions are affected?

@budibase/server (npm) SEMVER:introduced=0,last_affected=3.38.1.

Is there a fix for CVE-2026-72859?

A patch was published on 2026-07-22: Fix released in version 3.40.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-72859 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-72859?

Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72859: Budibase S3 presigned URL authorization regression

CVE-2026-72859 · Severity: high · CVSS 7.7 · Published 2026-08-14

Budibase is a low-code platform for building business applications and automations. A regression in version 3.39.4 allows basic app users to generate S3 file upload URLs (presigned URLs) that should only be available to admin/builder users. An attacker with basic user access can exploit this to write arbitrary files to any S3 bucket connected to the application, potentially compromising data integrity and enabling malicious content injection.

Technologies: @budibase/server (npm). Vendors: npm.

Quick answers

Is CVE-2026-72859 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-72859 being exploited in the wild.
How severe is CVE-2026-72859?: High severity, with a CVSS score of 7.7, published 14 August 2026.
Which products and versions are affected?: @budibase/server (npm) SEMVER:introduced=0,last_affected=3.38.1.
Is there a fix for CVE-2026-72859?: A patch was published on 2026-07-22: Fix released in version 3.40.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72859 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-72859?: Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass (CWE-863) in the S3 attachment upload endpoint (/api/attachments/:datasourceId/url). The route's permission check was incorrectly changed from BUILDER level (v3.39.3) to TABLE/WRITE level (v3.39.4) in a regression. Since BASIC app users have default TABLE/WRITE permissions, they can now call this endpoint. Additionally, the controller accepts the S3 bucket name directly from the request body without validating it against the datasource's configured bucket, allowing writes to any S3 bucket accessible by the application's IAM credentials. The attack requires network access and a valid Budibase app user account with BASIC role or higher. The vulnerability is fixed in version 3.40.0 by restoring the BUILDER authorization requirement and pinning bucket writes to the configured datasource bucket.

Affected products

Budibase Budibase <3.40.0 (affected from v3.39.4; fixed in v3.40.0)

Identifiers

CVE-2026-72859
GHSA-xcx6-4f2g-hhgx

Timeline

2026-07-24: disclosed
2026-07-22: patched: Fix released in version 3.40.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.