CVE-2026-72859

creationtimestamp| type| source ---|---|--- 2026-08-14 13:00:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mt27onnygj22 2026-08-14 13:14:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4wnroozl42xda...

CVE-2026-72859

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...