CVE Intelligence
Analysis AI-assisted

CVE-2026-50137: Budibase Missing Authorization on S3 Upload URL Endpoint

Budibase versions before 3.39.0 expose an attachment upload URL endpoint without an authorization check. An unauthenticated caller who can identify a workspace and an S3 datasource may obtain a pre-signed write URL signed with the datasource's cloud credentials. The record states the issue is fixed in 3.39.0 and is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Budibase is an open-source low-code platform. According to the record, versions before 3.39.0 contain a missing-authorization flaw (CWE-862) in an attachment upload URL endpoint that can be reached without authentication. See the GitHub security advisory.

Impact

  • Unauthenticated callers who know or can enumerate a workspace identifier and an S3 datasource identifier can obtain a short-lived pre-signed upload URL signed with the datasource's stored cloud credentials.
  • Because the bucket is not pinned to the datasource's configured bucket, the reach may extend to other buckets those credentials can write to.
  • NVD lists a CVSS 3.1 base score of 9.4. GitHub lists a CVSS 4.0 score of 8.2.

Affected products and versions

  • Budibase, versions earlier than 3.39.0.
  • The record states the issue is fixed in 3.39.0.

Exploitation status

CISA KEV does not list this CVE in the record. No confirmed exploitation in the wild appears in the sources consulted. The GitHub reference is tagged as Exploit in the record, but that tag does not confirm active exploitation.

Remediation and mitigation

  • Upgrade Budibase to version 3.39.0 or later, as stated in the record.
  • Review the vendor advisory, which the record lists as a mitigation reference, for any interim measures.
  • Until the upgrade is complete, limit network exposure of affected instances.
  • If compromise is suspected, rotate the cloud credentials stored in S3 datasources.
  • Restrict datasource IAM permissions to the minimum buckets and actions required.

Detection guidance

  • Review application and web server logs for unauthenticated requests to attachment upload URL routes, especially from non-browser clients.
  • Monitor cloud storage logs for object writes to buckets that the Budibase deployment does not normally use.
  • Investigate requests that reference workspace or datasource identifiers unexpectedly.

Limitations of the available information

  • The record gives only the range earlier than 3.39.0 and does not list other affected version details.
  • The fix entry is typed as mitigation, while the description states the fix is in 3.39.0. The sources consulted give no further detail.
  • The record contains no NVD CVSS 4.0 score.
  • EPSS shows a probability of 0.00415 and a percentile of 0.33995, dated 2026-10-13 in the record.
  • Practical exploitability depends on deployment details that the record does not provide.

Frequently asked questions

Which Budibase versions are affected by CVE-2026-50137?

The record lists Budibase versions earlier than 3.39.0 as affected. The description states the issue is fixed in 3.39.0.

Is this vulnerability known to be actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted.

What should administrators do first?

Upgrade Budibase to 3.39.0 or later, limit network exposure until the upgrade is done, and rotate S3 datasource credentials if compromise is suspected.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.