CVE-2026-50137

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.0

Description An authentication bypass exists in the Budibase server route POST /api/attachments/:datasourceId/url because it lacks the authorized(...) middleware. An anonymous attacker who can enumerate a workspace ID (app ...) and an S3-source datasource ID (ds ...) can call this endpoint to obtain a 15-minute pre-signed PUT URL. This URL is minted using the victim's IAM identity, allowing the attacker to write arbitrary objects to any S3 bucket that the IAM credentials have permission to access, not just the bucket configured for the datasource. The endpoint also returns the publicUrl, confirming the destination of the uploaded file. The issue is further exacerbated by the currentWorkspace middleware, which fails to block non-browser clients (such as curl) from accessing development workspaces.

Recommendations Update Budibase to version 3.39.0 or later. As a temporary mitigation, restrict access to the POST /api/attachments/:datasourceId/url endpoint to authorized users only.