CVE-2026-54356: Missing Authorization in Budibase leading to Arbitrary S3 Upload URL Generation
Vulnerability ID: CVE-2026-54356
CVSS Score: 7.1
Published: 2026-08-26
CVE-2026-54356 is a missing authorization vulnerability (CWE-862) within the backend component of the Budibase low-code platform. The vulnerability exists inside the @budibase/server package in versions prior to 3.41.3. An authenticated user with the lowest privilege level can invoke the attachment upload URL endpoint directly and obtain an S3 pre-signed PutObject URL signed with the server's S3 credentials.
TL;DR
An authenticated low-privilege user can obtain server-signed AWS S3 pre-signed upload URLs from Budibase and write arbitrary files directly to S3.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-862: Missing Authorization
- Attack Vector: Network (AV:N)
- CVSS v3.1 Score: 7.1 (High)
- Exploit Status: Proof-of-Concept Available
- Affected Versions: < 3.41.3
- Patch Version: 3.41.3
Affected Systems
Code Analysis
Commit: 0f1a20e
Fix broken authorization on S3 attachment signed URL generation
Exploit Details
- GitHub: Exploit PoC repository by KovachVL
Mitigation Strategies
- Upgrade the Budibase instance to version 3.41.3 or newer.
- Implement AWS IAM least-privilege policies for S3 credentials.
- Monitor S3 bucket logs and audit PutObject events using AWS CloudTrail.
Remediation Steps:
- Determine the current Budibase version deployed on the system.
- Apply the vendor-provided patch by upgrading the platform to version 3.41.3.
- Configure restricted AWS IAM policies for the S3 credentials used in Budibase to limit write access to specific prefixes.
References
Read the full report for CVE-2026-54356 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)