Skip to main content

Budibase CVE-2026-72859

| EUVDEUVD-2026-58653 HIGH
Incorrect Authorization (CWE-863)
2026-08-14 VulnCheck GHSA-9pwj-99rm-cq6j
Authentication Bypass Server
8.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.3 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.7 HIGH

Network-accessible endpoint requiring only BASIC user auth (PR:L); scope change (S:C) because attacker writes to external S3 buckets beyond the Budibase system; integrity-only impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 14, 2026 - 13:01 EUVD
Source Code Evidence Fetched
Aug 14, 2026 - 12:22 vuln.today
Analysis Generated
Aug 14, 2026 - 12:22 vuln.today
CVE Published
Aug 14, 2026 - 11:35 cve.org
HIGH 8.3

DescriptionCVE.org

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users hold by default. Attackers can specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket accessible by the stored IAM credentials, enabling unauthorized file uploads.

AnalysisAI

Authorization regression in Budibase v3.39.4 enables any authenticated BASIC user to generate S3 PutObject presigned URLs for arbitrary S3 buckets, bypassing the intended BUILDER-level permission gate on the attachment upload endpoint. The regression introduced in v3.39.4 - where the route guard was changed from authorized(BUILDER) to authorized(PermissionType.TABLE, PermissionLevel.WRITE) - gives all default BASIC users access to an endpoint that was explicitly restricted to builders. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate as BASIC Budibase user
Delivery
Discover valid S3 datasource ID from app API responses
Exploit
POST crafted request to /api/attachments/<datasourceId>/url with attacker-chosen bucket and key
Execution
Receive valid S3 PutObject presigned URL
Impact
Upload arbitrary content directly to target S3 bucket
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold a BASIC user account on the target Budibase application - the lowest authenticated role available. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.3 with vector AV:N/AC:L/AT:N/PR:L/UI:N reflects a network-accessible, low-complexity attack requiring only a BASIC user account - the lowest authenticated tier on the platform. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An external contractor with a BASIC user account on a Budibase deployment discovers a valid S3 datasource ID by enumerating application API responses or inspecting browser network traffic during normal platform use. They craft a POST request to `/api/attachments/<datasourceId>/url` with `{'bucket': 'company-public-assets', 'key': 'malicious.html'}`, receive a valid S3 PutObject presigned URL in the response, and use it to upload a credential-harvesting HTML page to the company's public-facing S3 bucket - no AWS credentials required beyond the platform's stored IAM keys. …
Remediation The primary remediation is to upgrade Budibase server to version 3.40.0 or later per the CVE description, which covers the fix for the v3.39.4 regression. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, verify your Budibase version and review S3/CloudTrail access logs for unauthorized PutObject operations against configured buckets. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Server

View all
CVE-2018-1000881 CRITICAL POC
9.8 Dec 20

Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
CVE-2026-60104 CRITICAL POC
9.3 Jul 08

Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
CVE-2026-43639 HIGH POC
8.9 May 11

Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
CVE-2021-42973 HIGH POC
8.8 Dec 07

NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
CVE-2021-42972 HIGH POC
8.8 Dec 07

NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
CVE-2026-43640 HIGH POC
8.6 May 11

Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
CVE-2019-25609 HIGH POC
8.6 Mar 22

JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
CVE-2023-30223 HIGH POC
7.5 Jun 16

A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
CVE-2023-30222 HIGH POC
7.5 Jun 16

An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
CVE-2026-57520 HIGH POC
7.1 Jun 25

Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
CVE-2026-71959 MEDIUM POC
6.9 Aug 10

Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may injec
CVE-2017-7855 MEDIUM POC
6.1 Aug 31

In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" paramet

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-72859 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy