Vulnerability · Published Aug 14, 2026 · Assigned by VulnCheck

CVE-2026-72859Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL

High 7.7

In plain English

A high-severity incorrect authorization in server from budibase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.2%top 87.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users hold by default. Attackers can specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket accessible by the stored IAM credentials, enabling unauthorized file uploads.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@budibase/server	no fix listed	GHSA-xcx6-4f2g-hhgx

Affected products (as reported)

Vendor	Product	Versions
budibase	server	3.39.4 – before 3.40.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

References

GitHub Security Advisory (GHSA-xcx6-4f2g-hhgx) vendor-advisory
VulnCheck Advisory: Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL third-party-advisory