CVE-2026-54356CWE-862broken-access-control

CVE-2026-54356

High · published August 18, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
27.6
In the wild
Unconfirmed
What it is

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00352 · 27.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-18T01:16Z
References (3)
https://github.com/Budibase/budibase/releases/tag/3.41.3 · [email protected]https://github.com/Budibase/budibase/security/advisories/GHSA-6x9p-4r67-5gjx · [email protected]https://github.com/Budibase/budibase/security/advisories/GHSA-6x9p-4r67-5gjx · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 AUG 20:32Z
    Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`
    cvelistv5