CVE-2026-72859 Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL
BASIC users can generate S3 presigned URLs to upload files to arbitrary buckets due to a permission check regression in the attachment endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72859?
CVE-2026-72859 is a high-severity missing authorization vulnerability in budibase server, published on 14 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users hold by default. Attackers can specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket accessible by the stored IAM credentials, enabling unauthorized file uploads.
Weakness: CWE-863
Which versions are affected by CVE-2026-72859?
2 open source packages ship an affected version, including @budibase/server.
| Package | Affected | Fixed in |
|---|---|---|
@budibase/server npm | All versions to 3.38.1 | None |
@budibase/server npm | All versions to 3.38.1 | None |
How do I fix CVE-2026-72859?
No fix has been published for CVE-2026-72859 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-72859 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72859 exists.
Sources
Also known as GHSA-9pwj-99rm-cq6j, GHSA-xcx6-4f2g-hhgx.