EUVD-2026-60382Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
PR:L reflects required BASIC-role authentication; C:L added because signed URLs may permit read access to arbitrary S3 objects beyond C:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Lifecycle Timeline
4DescriptionCVE.org
Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.
AnalysisAI
Unauthorized S3 signed-URL generation in Budibase prior to 3.41.3 allows any authenticated published-app user holding the low-privilege BASIC role to supply arbitrary bucket and key values to POST /api/attachments/:datasourceId/url and receive valid signedUrl and publicUrl values generated using the application's stored S3 datasource credentials. The root cause is missing authorization (CWE-862) on this endpoint, which fails to restrict low-privileged app users from invoking datasource-credential-backed operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session as a BASIC-role user in a Budibase published application - this is the lowest built-in role and is typically assigned to end-users of deployed apps. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) scores 7.1, and the attack complexity and privilege ratings are well-calibrated: exploitation requires only a valid BASIC-role account in a published Budibase app, which is the lowest user tier and broadly granted to end-users in production deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds a BASIC-role account in a published Budibase application sends a crafted POST request to /api/attachments/:datasourceId/url with an attacker-controlled bucket name and key path in the request body. The Budibase server - without authorization checks - uses its stored S3 datasource credentials to generate a valid AWS pre-signed URL for that arbitrary path and returns it to the attacker. … |
| Remediation | Upgrade Budibase to version 3.41.3 or later; this is the vendor-confirmed fix per the GitHub security advisory (https://github.com/Budibase/budibase/security/advisories/GHSA-6x9p-4r67-5gjx) and the release tag at https://github.com/Budibase/budibase/releases/tag/3.41.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all production Budibase instances and identify which have S3 datasources configured, along with the count of BASIC-role users in published apps that can access them. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att
Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]
Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email
Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat
OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Rated med
Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app
SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S
Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep
Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an
Authentication bypass in Budibase low-code platform (versions prior to 3.35.4) allows remote unauthenticated attackers t
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today