A Budibase server exposes a POST /api/attachments/:datasourceId/url endpoint that accepts calls without authentication. The controller builds an AWS S3 client with credentials stored in the datasource and returns a pre‑signed PutObjectCommand URL that the caller can use to write to any S3 bucket the credentials permit for 15 minutes. The caller also receives the publicUrl of the bucket, allowing them to target arbitrary buckets, not only the one intended for the datasource. This missing authorization (CWE‑862) allows an attacker to modify or exfiltrate data in S3 buckets without any prior access, potentially violating confidentiality, integrity, and availability of the data stored there.

Budibase platform versions prior to 3.39.0 are vulnerable when one or more S3 datasource credentials are configured. Any deployed instance that has an S3 datasource configured with IAM credentials is affected, regardless of the workspace’s visibility or active status. The vulnerability is fixed in Budibase 3.39.0 and later.

The CVSS score of 8.2 reflects a high impact due to unauthenticated access and potential data compromise. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred: an attacker who can enumerate or knows a workspace ID (app_…) and a datasource ID (ds_…) can issue an unauthenticated request to the endpoint and obtain a pre‑signed PUT URL. Once the URL is received, the attacker can write to any bucket that the credentials allow, with a 15‑minute validity window. The required knowledge of IDs may limit exploitation to insiders or those who can discover them through enumeration, but once obtained the impact is severe.