CVE-2026-50136 | Budibase is an open-source low-code platform. Prior to 3.39.… | CVSS 7.4 HIGH

Description

Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require authentication, table permission, datasource permission, or builder access. A public caller who knows a workspace ID and S3 datasource ID can request a signed upload URL for attacker-controlled bucket and key values. This vulnerability is fixed in 3.39.3.

Metadata

CVE ID: CVE-2026-50136
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-03 18:49 UTC
Published: 2026-06-26 20:36 UTC
Last updated: 2026-06-27 03:14 UTC
Primary CWE: CWE-306
CWE-306: Missing Authentication for Critical Function
Vendor / Product: Budibase / budibase
Sources: cve.org · NVD

Severity & Metrics

7.4 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Budibase	budibase	—	< 3.39.3

Weakness (CWE)

CWE	Source	Description
CWE-306	cna	CWE-306: Missing Authentication for Critical Function

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.4	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

References (1)

https://github.com/Budibase/budibase/security/advisories/GHSA-jj36-r9w3-3pfh https://github.com/Budibase/budibase/security/advisories/GHSA-jj36-r9w3-3pfh