Budibase versions 3.39.4 and earlier releases contain an authorization regression in the S3 attachment upload endpoint. The endpoint was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users possess by default. When a BASIC user posts to the attachments endpoint and specifies any S3 bucket name in the request body, the application issues a presigned S3 PutObject URL that allows the attacker to upload data to that bucket. This flaw lets an authenticated user write arbitrary content to any bucket that the application’s IAM credentials can reach, giving unauthorized S3 write access.

Budibase server deployments running budibase:server with any version before 3.40.0 are affected. No specific earlier releases are cited outside of the fact that 3.39.4 is vulnerable.

The vulnerability carries a CVSS score of 8.3, indicating high severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog. Attackers simply need to be authenticated BASIC users with network reach to the attachment endpoint; by crafting a POST request with an arbitrary bucket name they can receive a presigned URL and upload files, potentially leading to data tampering or unauthorized exfiltration.