CVE-2026-50136

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.3

Description The application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by recaptcha middleware and does not require authentication, table permissions, datasource permissions, or builder access. An attacker who knows a workspace ID and S3 datasource ID can request a signed upload URL by providing attacker-controlled bucket and key values in the request body. This allows unauthenticated arbitrary object writes to any location where the stored S3 datasource credentials have PutObject access, potentially leading to data corruption, overwriting public assets, or abuse of cloud credentials.

API Endpoint: /api/attachments/:datasourceId/url Vulnerable Parameters: bucket and key

Recommendations Update Budibase to version 3.39.3.