What is the CVSS score of CVE-2026-54356?

CVE-2026-54356 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.4%.

Which versions of Budibase are affected by CVE-2026-54356?

Budibase S3 integrations in versions prior to 3.41.3 allow any low-privilege user with the BASIC role to generate unauthorized signed URLs for arbitrary S3 buckets using the application's stored AWS…. A patch is available.

How to fix or mitigate CVE-2026-54356?

Within 24 hours, inventory all production Budibase instances and identify which have S3 datasources configured, along with the count of BASIC-role users in published apps that can access them. Within 7 days, implement immediate mitigations: revoke BASIC-role access to any published apps exposing S3 datasources and restrict S3 operations to users with elevated privilege levels; enable S3 bucket policy enforcement to reject unsigned or source-restricted requests; and activate CloudTrail and S3 access logging with alerting on signed-URL generation activity. Within 30 days, monitor the Budibase vendor advisory channel for patch availability (no fix currently released); once version 3.41.3 or later is released, conduct staging validation and deploy to all production instances, then review S3 access logs for unauthorized activity during the vulnerability window.

Budibase CVE-2026-54356

EUVD-2026-60382 HIGH

Missing Authorization (CWE-862)

2026-08-17 GitHub_M

GHSA-6x9p-4r67-5gjx

Authentication Bypass Budibase

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

vuln.today AI

7.6 HIGH

PR:L reflects required BASIC-role authentication; C:L added because signed URLs may permit read access to arbitrary S3 objects beyond C:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Aug 17, 2026 - 21:17 EUVD

Source Code Evidence Fetched

Aug 17, 2026 - 21:12 vuln.today

Analysis Generated

Aug 17, 2026 - 21:12 vuln.today

CVE Published

Aug 17, 2026 - 20:32 cve.org

HIGH 7.1

DescriptionCVE.org

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.

AnalysisAI

Unauthorized S3 signed-URL generation in Budibase prior to 3.41.3 allows any authenticated published-app user holding the low-privilege BASIC role to supply arbitrary bucket and key values to POST /api/attachments/:datasourceId/url and receive valid signedUrl and publicUrl values generated using the application's stored S3 datasource credentials. The root cause is missing authorization (CWE-862) on this endpoint, which fails to restrict low-privileged app users from invoking datasource-credential-backed operations. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and the wide availability of BASIC-role accounts in published Budibase apps makes this a realistic internal threat.

Technical ContextAI

Budibase is an open-source low-code platform (cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*) that lets users build and publish data-driven applications backed by external datasources, including AWS S3. The vulnerable endpoint - POST /api/attachments/:datasourceId/url - is implemented in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts. It is designed to generate pre-signed S3 URLs for file attachment workflows, but it fails to enforce authorization checks (CWE-862: Missing Authorization) gating which user roles may invoke it. Because Budibase stores S3 credentials at the datasource level and passes them server-side to AWS's signing API, a BASIC-role user who calls this endpoint with attacker-chosen bucket and key parameters can compel the Budibase server to generate valid AWS signed URLs for arbitrary S3 paths - effectively leveraging the application's privileged AWS identity on the caller's behalf.

RemediationAI

Upgrade Budibase to version 3.41.3 or later; this is the vendor-confirmed fix per the GitHub security advisory (https://github.com/Budibase/budibase/security/advisories/GHSA-6x9p-4r67-5gjx) and the release tag at https://github.com/Budibase/budibase/releases/tag/3.41.3. For organizations that cannot immediately upgrade, a compensating control is to restrict published-app access so that untrusted or external users cannot obtain BASIC-role accounts - this reduces the attacker pool but does not eliminate the vulnerability for any authenticated user. Additionally, operators should audit the IAM policies attached to the S3 credentials stored in Budibase datasources and apply least-privilege scoping (e.g., restrict to specific bucket prefixes, deny ListBucket), which limits the blast radius of any signed URL abuse even if the endpoint is reached. Note that restricting IAM policies is a mitigation against impact, not against exploitation, and does not substitute for patching.