CVE-2026-54356

CVE-2026-54356 — Budibase: authenticated arbitrary S3 signed upload URL issuance A low-privilege BASIC role authenticated user of a published Budibase workspace can call POST /api/attachments/:datasourceId/url and obtain an S3 pre-signed upload URL signed with the workspace datasource's server-si...

Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Summary Budibase 3.39.7 allows a low-privilege authenticated published-app user with the built-in BASIC role to obtain arbitrary S3 pre-signed upload URLs backed by a workspace datasource's stored server-side credentials. The affected endpoint is: POST /api/attachments/:datasourceId/url The calle...