Budibase Authentication Bypass in S3 Attachment Endpoint

Budibase version 3.38.1 and earlier contains an authorization bypass vulnerability (CVE-2026-54356) that affects the /api/attachments/:datasourceId/url endpoint. Research confirms that while the development environment correctly enforces role-based access control, the published production environment fails to properly validate the 'BASIC' role permissions. An authenticated user assigned to a published application can invoke this endpoint to generate pre-signed S3 PUT URLs.

Because the underlying application logic uses configured server-side datasource credentials to generate these URLs, the attacker can force the application to issue credentials for arbitrary S3 buckets and keys. This allows a low-privileged user to potentially upload, overwrite, or manipulate objects in storage environments accessible to the application's service principal or stored IAM credentials, effectively escalating their impact beyond the application's intended scope.

Attack Chain

1. Attacker authenticates to a published Budibase application as a low-privileged user with the 'BASIC' role.
2. Attacker enumerates or identifies a valid datasourceId associated with an S3-compatible storage integration.
3. Attacker sends a POST request to /api/attachments/<datasourceId>/url targeting the vulnerable endpoint.
4. Attacker includes the required application headers, specifically x-budibase-app-id, to bypass initial routing constraints.
5. Attacker provides a JSON payload containing their chosen bucket and key values for the target S3 path.
6. The application performs an insufficient authorization check in packages/server/src/middleware/authorized.ts.
7. The server generates a pre-signed PUT URL using the backend S3 credentials and returns it to the attacker.
8. Attacker utilizes the signed URL to perform unauthorized file write operations against the target S3 infrastructure.

Impact

The vulnerability allows unauthorized users to mint S3 upload credentials by leveraging the application's server-side identity. This enables unauthorized modification or injection of files into S3 buckets accessible by the application's configured credentials. Successful exploitation could lead to data integrity compromise or, if the application serves uploaded content, stored Cross-Site Scripting (XSS) or arbitrary code execution via file upload, depending on the downstream handling of the S3 objects.

Recommendation

1. Upgrade Budibase to version 3.39.7 or later to implement proper authorization checks on the attachment API.
2. Audit S3 bucket policies for all datasources configured in Budibase to enforce the principle of least privilege, ensuring the application credentials cannot perform writes to unauthorized paths.
3. Deploy webserver logs monitoring for POST requests to /api/attachments/*/url that originate from users with the 'BASIC' role or other low-privilege accounts, and cross-reference these with subsequent outbound traffic to AWS S3 endpoints.