CVE-2026-50137

Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id (app_...) and an S3-source datasource id (ds_...) can call this endpoint with no auth and obtain a 15-minute pre-signed PUT URL minted on the victim's IAM identity. The endpoint also returns the publicUrl so the attacker knows exactly where their PUT lands. Because bucket is attacker-controlled, the attacker can write to any bucket those IAM credentials can write to, not only the bucket the datasource was configured for. The Budibase server route POST /api/attachments/:datasourceId/url (packages/server/src/api/routes/static.ts) is registered with only the recaptcha middleware. There is no authorized(...) middleware in the chain. The controller (packages/server/src/api/controllers/static/index.ts::getSignedUploadURL) looks the requested datasource up, instantiates an AWS S3 client with the datasource's stored accessKeyId / secretAccessKey, and returns an AWS Signature V4 pre-signed PutObjectCommand URL for the caller-supplied bucket and key. The bucket is not pinned to the datasource's configured bucket. The workspace context required by sdk.datasources.get is sourced by getWorkspaceIdFromCtx (packages/backend-core/src/utils/utils.ts) from any of: the x-budibase-app-id header, the JSON body appId, a path segment that begins with the workspace prefix, or ?appId=. auth.buildAuthMiddleware([], { publicAllowed: true }) runs before any of this and explicitly allows anonymous requests. The currentWorkspace middleware's "deny access to dev preview" branch only triggers under isBrowser(ctx) && !isApiKey(ctx); isBrowser checks the parsed User-Agent for a recognised browser, so any non-browser client (curl, the supplied PoC, any tool not setting a browser UA) is neither and reaches dev workspaces too. This vulnerability is fixed in 3.39.0.

• CWE-862

• https://github.com/Budibase/budibase/security/advisories/GHSA-35c4-rvc8-frhmExploit, Mitigation, Vendor Advisory
• https://github.com/Budibase/budibase/security/advisories/GHSA-35c4-rvc8-frhmExploit, Mitigation, Vendor Advisory

Published

Jun 26, 2026

Last Modified

Jun 30, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50131Fedify is a TypeScript library for building federated server…8.6
• CVE-2026-50132Budibase is an open-source low-code platform. Prior to 3.39.…7.3
• CVE-2026-50133Hugo is a static site generator. Prior to 0.162.0, Hugo acce…6.1
• CVE-2026-50134Hugo is a static site generator. From 0.91.0 until 0.162.0, …5.8
• CVE-2026-50135Hugo is a static site generator. From 0.123.0 to 0.161.1, a …5.5
• CVE-2026-50136Budibase is an open-source low-code platform. Prior to 3.39.…5.3
• CVE-2026-50138goshs is a SimpleHTTPServer written in Go. Prior to version …8.1
• CVE-2026-50139goshs is a SimpleHTTPServer written in Go. Prior to version …5.9
• CVE-2026-5014A vulnerability was found in elecV2 elecV2P up to 3.8.3. The…5.5
• CVE-2026-50141Woodpecker is a CI/CD engine. Starting in version 3.0.0 and …7.1
• CVE-2026-50142libheif is a HEIF and AVIF file format decoder and encoder. …7.5
• CVE-2026-50143The Apify MCP server enables AI agents to extract data from …8.1