Authorization Regression in Budibase by Budibase Corporation
CVE-2026-72859

8.3HIGH

Key Information:

Vendor

Budibase

Status
Server
Vendor
CVE Published:
14 August 2026

What is CVE-2026-72859?

Budibase versions earlier than 3.40.0 have a flaw in the S3 attachment upload functionality where BASIC users can exploit an authorization regression to obtain S3 PutObject presigned URLs. The permission check was improperly altered from requiring BUILDER permissions to allowing TABLE/WRITE permissions, which BASIC users possess by default. This misconfiguration permits attackers to specify any S3 bucket in their requests, leading to unauthorized uploads of files to buckets that are reachable through the existing IAM credentials.

Affected Version(s)

server 3.39.4 < 3.40.0

server 3.40.0

References

https://github.com/Budibase/budibase/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/budibase-before-auth...
third-party-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

DavidCarliez
.