CVE-2026-50136 Details
Description
Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require authentication, table permission, datasource permission, or builder access. A public caller who knows a workspace ID and S3 datasource ID can request a signed upload URL for attacker-controlled bucket and key values. This vulnerability is fixed in 3.39.3.
A vulnerability exists in Budibase versions prior to 3.39.3, where the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs. This is done using credentials stored in a workspace datasource. The endpoint is only protected by reCAPTCHA and does not require authentication, table permission, datasource permission, or builder access. A public caller with knowledge of a workspace ID and S3 datasource ID can request a signed upload URL for an attacker-controlled bucket and key. The vulnerability allows for unauthenticated arbitrary object writes to S3, potentially overwriting important data or abusing cloud storage resources.
Users are advised to update Budibase to version 3.39.3 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Budibase/budibase/security/advisories/GHSA-jj36-r9w3-3pfh | CISA-ADP | ExploitVendor Advisory |
| https://github.com/Budibase/budibase/security/advisories/GHSA-jj36-r9w3-3pfh | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| budibase budibase | < 3.39.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 30, 2026 | Initial Analysis | [email protected] |
| Jun 27, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |