{"items":[{"id":"NVI-00015376","kind":"vulnerability","title":" Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-xcx6-4f2g-hhgx"],"plain_summary":"GitHub lists this reviewed advisory for @budibase/server. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-624ebdbab5d70ecd569125d19ee03c59"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-24T21:17:04.000Z","value":"7.7 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-624ebdbab5d70ecd569125d19ee03c59"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-624ebdbab5d70ecd569125d19ee03c59","url":"https://github.com/advisories/GHSA-xcx6-4f2g-hhgx","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-xcx6-4f2g-hhgx","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T09:59:13.529Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-624ebdbab5d70ecd569125d19ee03c59"],"technology":"@budibase/server","known_exclusions":[],"conditions_summary":"## Impact\n\nIn Budibase v3.39.4, a regression in the authorization level for the S3 attachment upload endpoint allows any BASIC app user to obtain S3 PutObject presigned URLs. The endpoint uses TABLE/WRITE permission level instead of the intended BUILDER level defined in v3.39.3. Additionally, the controller does not pin the target bucket to the datasource's configured bucket, allowing writes to any S3 bucket the stored IAM credentials can access.\n\n## Reproduction\n\n1. As a BASIC app user, discover or obtain a valid S3 datasource ID within the app\n2. Send a POST request:\n\n```\nPOST /api/attachments//url\nContent-Type: application/json\nx-budibase-app-id: \n\n{\"bucket\": \"target-bucket\", \"key\": \"malicious-file.html\"}\n```\n\n3. The response contains a valid S3 PutObject presigned URL\n4. Use the presigned URL to upload arbitrary content to any writable S3 bucket in the IAM credential scope\n\n## Root Cause\n\nThe `/api/attachments/:datasourceId/url` route was changed from `authorized(BUILDER)` in v3.39.3 to `authorized(PermissionType.TABLE, PermissionLevel.WRITE)` in v3.39.4. BASIC users have TABLE/WRITE permissions by default, so they can call this endpoint. The controller at ","public_affected_ranges":["<= 3.38.1"]}],"null_published_at":"2026-11-03T10:03:31.359Z","source_updated_at":"2026-07-24T21:17:04.000Z","source_disclosed_at":"2026-07-24T21:17:03.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T09:59:13.529Z"}],"next_cursor":null,"snapshot_revision":"42594"}