{"uuid": "a5cf6d02-914b-422d-bb1b-6bbaa848de00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54356", "type": "seen", "source": "https://gist.github.com/alon710/3db07e14b08e03003c4cb301f74837ed", "content": "# CVE-2026-54356: CVE-2026-54356: Missing Authorization in Budibase leading to Arbitrary S3 Upload URL Generation\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-08-26\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54356\n\n## Summary\nCVE-2026-54356 is a missing authorization vulnerability (CWE-862) within the backend component of the Budibase low-code platform. The vulnerability exists inside the `@budibase/server` package in versions prior to 3.41.3. An authenticated user with the lowest privilege level can invoke the attachment upload URL endpoint directly and obtain an S3 pre-signed PutObject URL signed with the server's S3 credentials.\n\n## TL;DR\nAn authenticated low-privilege user can obtain server-signed AWS S3 pre-signed upload URLs from Budibase and write arbitrary files directly to S3.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862: Missing Authorization\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.1 (High)\n- **Exploit Status**: Proof-of-Concept Available\n- **Affected Versions**: < 3.41.3\n- **Patch Version**: 3.41.3\n\n## Affected Systems\n\n- Budibase (Packages: @budibase/server)\n- **Budibase (@budibase/server)**: < 3.41.3 (Fixed in: `3.41.3`)\n\n## Mitigation\n\n- Upgrade the Budibase instance to version 3.41.3 or newer.\n- Implement AWS IAM least-privilege policies for S3 credentials.\n- Monitor S3 bucket logs and audit PutObject events using AWS CloudTrail.\n\n**Remediation Steps:**\n1. Determine the current Budibase version deployed on the system.\n2. Apply the vendor-provided patch by upgrading the platform to version 3.41.3.\n3. Configure restricted AWS IAM policies for the S3 credentials used in Budibase to limit write access to specific prefixes.\n\n## References\n\n- [GitHub Security Advisory GHSA-6x9p-4r67-5gjx](https://github.com/Budibase/budibase/security/advisories/GHSA-6x9p-4r67-5gjx)\n- [NVD CVE-2026-54356 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-54356)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54356) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-27T09:34:14.687953Z"}