[GHSA-jj36-r9w3-3pfh] Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials

[Amayyas]

Updates

• CWEs

Comments
This advisory currently has no CWE assigned. The corresponding CVE record,
CVE-2026-50136 (assigned by the GitHub CNA), classifies this vulnerability as
CWE-306: Missing Authentication for Critical Function.

This is consistent with the advisory's own description: the
POST /api/attachments/:datasourceId/url endpoint generates S3 presigned upload
URLs and "does not require authentication, table permission, datasource
permission, or builder access" — a critical function exposed without
authentication.

Adding CWE-306 aligns the GitHub Advisory Database entry with the published CVE
record and improves classification and filtering.

References:

• CVE-2026-50136 (NVD): https://nvd.nist.gov/vuln/detail/CVE-2026-50136
• Source advisory: GHSA-jj36-r9w3-3pfh

[github]

Hi there @mjashanks! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.