CVE-2026-72859 budibase CVE debrief

Who should care

Budibase users, administrators, and security teams should be aware of this vulnerability and take steps to patch or mitigate. Budibase users should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Budibase users should prioritize patching to prevent unauthorized file uploads and review compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint. BASIC users can obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint, allowing unauthorized file uploads to any bucket accessible by the stored IAM credentials. This vulnerability enables attackers to specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket. Budibase users should prioritize patching to prevent unauthorized file uploads and review compensating controls for exposed systems while remediation is scheduled and verified.

Defensive priority

Budibase users should prioritize patching to prevent unauthorized file uploads.

Recommended defensive actions

• Patch Budibase to version 3.40.0 or later
• Restrict access to S3 buckets
• Monitor for unauthorized file uploads
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users hold by default. Attackers can specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket accessible by the stored IAM credentials, enabling unauthorized file uploads. Evidence is limited; verify affected versions and patch status. Budibase users should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.