CVE-2026-54356 in Budibase
Summary
by MITRE • 08/17/2026
Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in Budibase, a popular open-source low-code application development platform, represents a significant security flaw within its file attachment handling mechanisms prior to version 3.41.3. Specifically, the endpoint POST /api/attachments/:datasourceId/url located in packages/server/src/api/routes/static.ts and associated controllers allows for improper access control when interacting with external storage services like Amazon S3. The core technical issue stems from insufficient validation of user-supplied input parameters related to cloud storage identifiers. An authenticated user who has been assigned the BASIC role within a published application can manipulate the request payload to supply arbitrary bucket names and object keys rather than being restricted to legitimate, pre-configured data sources.
This lack of strict authorization checks allows an attacker to bypass intended isolation boundaries between different applications or tenants sharing the same Budibase instance. By injecting controlled values for the storage bucket and key fields, the application proceeds to generate signed URLs and public URLs using the underlying S3 datasource credentials stored within the platform's configuration. These generated URLs provide direct access to objects in the specified cloud storage buckets. Since the system trusts these inputs without verifying that they belong to a data source explicitly authorized for the requesting user or application context, it effectively exposes sensitive files that may reside in unrelated or restricted storage locations.
The operational impact of this vulnerability is severe, primarily centering on unauthorized data access and potential information disclosure. An attacker with basic authentication privileges can enumerate valid bucket names if they are known or guessable, leading to the retrieval of private documents, configuration files, backups, or other sensitive assets stored in those buckets. This constitutes a clear violation of confidentiality principles within cloud storage architectures. Furthermore, depending on the specific permissions associated with the S3 credentials used by Budibase, there may be risks beyond simple read access, although the primary vector described involves obtaining signed URLs for retrieval. The ability to generate these links means that even if direct API access is restricted, an attacker can obtain temporary or permanent public links to exfiltrate data externally.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-915 Improper Modification of Dynamically-Controlled Object Properties. The flaw allows an actor to modify the behavior of dynamically controlled object properties (the datasource credentials) by supplying malicious input that alters which storage resources are accessed. In terms of adversary tactics, this maps closely to ATT&CK technique T1078 Valid Accounts and potentially T1530 Data from Cloud Storage Object Databases if the attacker proceeds to exfiltrate data after gaining access via the signed URLs. The vulnerability highlights a critical gap in how low-code platforms handle integrations with external services, particularly when those integrations involve credential management and dynamic resource resolution based on user input.
Mitigation for this issue is straightforward as it has been addressed in version 3.41.3 of Budibase. Organizations running affected versions should immediately upgrade to the patched release where proper validation logic ensures that only data sources explicitly configured and authorized for a specific application can be accessed via these endpoints. Additionally, administrators should enforce the principle of least privilege by ensuring that S3 credentials associated with different applications do not have overly broad permissions across multiple unrelated buckets. Regular security audits of low-code platform configurations are recommended to verify that external integrations adhere to strict access control policies and that user roles are correctly scoped to prevent lateral movement or unauthorized resource discovery through API endpoints.