An authenticated user with the BASIC role on a published app can call POST /api/attachments/:datasourceId/url to supply arbitrary bucket and key values. The server returns signedUrl and publicUrl values that use stored S3 datasource credentials. This allows the user to upload or download files to an arbitrary S3 location, potentially exfiltrating or injecting data. The flaw is an implementation of incorrect authorization, identified as CWE-862.

Budibase, an open-source low‑code platform. All releases prior to version 3.41.3 are affected; the issue is resolved in 3.41.3 and later.

The CVSS score of 7.1 indicates medium‑high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a logged‑in user with the BASIC role on a published app, so exploitation is limited to authenticated users. No public exploits are reported, but the ability to obtain signed S3 URLs can lead to serious confidentiality and integrity damage if abused.