{"id":"CVE-2026-50136","title":"Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials","summary":"Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials","severity":"high","cvss":7.4,"vendor":"budibase","product":"@budibase/server","ecosystem":"npm","affected":["@budibase/server < 3.39.2"],"patched":["@budibase/server 3.39.2"],"published":"2026-06-22","updated":"2026-06-22","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-jj36-r9w3-3pfh","references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-jj36-r9w3-3pfh"},{"url":"https://github.com/Budibase/budibase/pull/18774"},{"url":"https://github.com/Budibase/budibase/commit/d9dbb7f6105373cc88ecacdbcab70c776f7dd6a1"},{"url":"https://github.com/advisories/GHSA-jj36-r9w3-3pfh"}],"tags":["ghsa","npm"],"epss":0.0029,"epssPercentile":0.21809,"ingestedAt":"2026-06-29T13:24:35.490Z","slug":"CVE-2026-50136","body":"## Overview\n\nThe application server exposes an unauthenticated endpoint that generates S3 `PutObject` presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require authentication, table permission, datasource permission, or builder access. A public caller who knows a workspace ID and S3 datasource ID can request a signed upload URL for attacker-controlled bucket and key values.\n\n### Details\n\nThe static route registers the signed upload URL endpoint with only `recaptcha` before the controller:\n\n- `packages/server/src/api/routes/static.ts:44-48`\n\n```ts\n44:  .post(\n45:    \"/api/attachments/:datasourceId/url\",\n46:    recaptcha,\n47:    controller.getSignedUploadURL\n48:  )\n```\n\nThe controller loads the datasource by `datasourceId` with enriched secret values:\n\n- `packages/server/src/api/controllers/static/index.ts:590-598`\n\n```ts\n590:export const getSignedUploadURL = async function (\n591:  ctx: Ctx<GetSignedUploadUrlRequest, GetSignedUploadUrlResponse>\n592:) {\n593:  // Ensure datasource is valid\n594:  let datasource\n595:  try {\n596:    const { datasourceId } = ctx.params\n597:    datasource = await sdk.datasources.get(datasourceId, { enriched: true })\n598:    if (!datasource) {\n```\n\nThe request body controls `bucket` and `key`, and the server signs a PUT URL using the stored datasource credentials:\n\n- `packages/server/src/api/controllers/static/index.ts:609-629`\n\n```ts\n609:  if (datasource?.source === \"S3\") {\n610:    const { bucket, key } = ctx.request.body || {}\n611:    if (!bucket || !key) {\n612:      ctx.throw(400, \"bucket and key values are required\")\n613:    }\n614:    try {\n615:      let endpoint = datasource?.config?.endpoint\n616:      if (endpoint && !utils.urlHasProtocol(endpoint)) {\n617:        endpoint = `https://${endpoint}`\n618:      }\n619:      const s3 = new S3({\n620:        region: awsRegion,\n621:        endpoint: endpoint,\n622:        credentials: {\n623:          accessKeyId: datasource?.config?.accessKeyId as string,\n624:          secretAccessKey: datasource?.config?.secretAccessKey as string,\n625:        },\n626:      })\n627:      const params = { Bucket: bucket, Key: key }\n628:      signedUrl = await getSignedUrl(s3, new PutObjectCommand(params))\n629:      if (endpoint) {\n```\n\nThe endpoint returns the signed URL and public URL to the caller:\n\n- `packages/server/src/api/controllers/static/index.ts:630-639`\n\n```ts\n630:        publicUrl = `${endpoint}/${bucket}/${key}`\n631:      } else {\n632:        publicUrl = `https://${bucket}.s3.${awsRegion}.amazonaws.com/${key}`\n633:      }\n634:    } catch (error: any) {\n635:      ctx.throw(400, error)\n636:    }\n637:  }\n638:\n639:  ctx.body = { signedUrl, publicUrl }\n```\n\nBecause no authorization middleware is applied, the API trusts public input to choose where the stored S3 credentials will write.\n\n### PoC\n\nNon-destructive validation approach:\n\n1. Create or identify a workspace with an S3 datasource.\n2. Obtain the production workspace ID and S3 datasource ID.\n3. Send an unauthenticated request with the workspace ID header and attacker-controlled bucket/key:\n\n```http\nPOST /api/attachments/<datasourceId>/url HTTP/1.1\nx-budibase-app-id: app_<workspace-id>\ncontent-type: application/json\n\n{\"bucket\":\"attacker-controlled-or-permitted-bucket\",\"key\":\"poc/budibase.txt\"}\n```\n\n4. Observe that the response contains a signed PUT URL.\n5. Upload harmless content to the returned `signedUrl` and confirm the object is created using the datasource's stored S3 credentials.\n\n### Impact\n\nThis allows unauthenticated arbitrary object writes wherever the stored S3 datasource credentials have `PutObject` access. Depending on the datasource permissions, this can corrupt application data, overwrite public assets, place attacker-controlled objects in trusted buckets, consume storage, or abuse an organization's cloud credentials.\n\n## Affected packages\n\n- `@budibase/server < 3.39.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@budibase/server 3.39.2`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}