GHSA-xcx6-4f2g-hhgx: Budibase S3 Presigned URL Endpoint Authorization Vulnerability
HIGHGHSA-xcx6-4f2g-hhgx is a HIGH (CVSS 7.7) s3 presigned url endpoint authorization vulnerability (CWE-863: Incorrect Authorization) affecting Budibase libraries in the npm ecosystem. The issue involves s3 presigned url endpoint authorization regression in v3.39.4 allows basic users to obtain s3 putobject presigned urls. Remediation is available in the latest vendor maintenance releases.
GHSA-xcx6-4f2g-hhgx at a Glance
Security Impact
CVSS: 7.7
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N).
How to Fix GHSA-xcx6-4f2g-hhgx
To remediate this vulnerability, upgrade all affected Budibase dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @budibase/server@Latest secure releaseRun the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @budibase/serverHow to Check if You Are Affected
To determine whether your Node.js application is affected by GHSA-xcx6-4f2g-hhgx, inspect your project dependencies using npm:
npm ls @budibase/serverAnalyze the terminal output to locate any version of Budibase in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: The npm ls @budibase/server command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-863: Incorrect Authorization, where the product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. In Budibase, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-xcx6-4f2g-hhgx Affected Budibase Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@budibase/server
|
npm |
≤ 3.38.1
|
|
References
Frequently Asked Questions
What is GHSA-xcx6-4f2g-hhgx?
Which Budibase versions are affected?
What version fixes GHSA-xcx6-4f2g-hhgx?
Is @budibase/server affected?
What is the CVSS score of GHSA-xcx6-4f2g-hhgx?
What CWE is associated with GHSA-xcx6-4f2g-hhgx?
How can I check npm dependencies for GHSA-xcx6-4f2g-hhgx?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-xcx6-4f2g-hhgx",
"modified" : "2026-07-24T21:17:03Z",
"published" : "2026-07-24T21:17:03Z",
"aliases" : [ ],
"summary" : " Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs",
"details" : "## Impact\n\nIn Budibase v3.39.4, a regression in the authorization level for the S3 attachment upload endpoint allows any BASIC app user to obtain S3 PutObject presigned URLs. The endpoint uses TABLE/WRITE permission level instead of the intended BUILDER level defined in v3.39.3. Additionally, the controller does not pin the target bucket to the datasource's configured bucket, allowing writes to any S3 bucket the stored IAM credentials can access.\n\n## Reproduction\n\n1. As a BASIC app user, discover or obtain a valid S3 datasource ID within the app\n2. Send a POST request:\n\n```\nPOST /api/attachments/<datasourceId>/url\nContent-Type: application/json\nx-budibase-app-id: <appId>\n\n{\"bucket\": \"target-bucket\", \"key\": \"malicious-file.html\"}\n```\n\n3. The response contains a valid S3 PutObject presigned URL\n4. Use the presigned URL to upload arbitrary content to any writable S3 bucket in the IAM credential scope\n\n## Root Cause\n\nThe `/api/attachments/:datasourceId/url` route was changed from `authorized(BUILDER)` in v3.39.3 to `authorized(PermissionType.TABLE, PermissionLevel.WRITE)` in v3.39.4. BASIC users have TABLE/WRITE permissions by default, so they can call this endpoint. The controller at `packages/server/src/api/controllers/static/index.ts:614-632` accepts the `bucket` parameter directly from the request body and passes it to `getSignedUrl` without validating against the datasource's configured bucket.\n\n## Evidence\n\nThe test suite at `packages/server/src/api/routes/tests/static.spec.ts:218-235` confirms this behavior. The test authenticates as a BASIC role user and successfully generates a signed upload URL, verifying HTTP 200 and a defined `res.body.signedUrl`.\n\n## Remediation\n\n1. Restore the `authorized(BUILDER)` middleware on the route\n2. Add `paramResource(\"datasourceId\")` to ensure the datasource belongs to the caller's app\n3. Pin the S3 bucket to `datasource.config.bucket` in the controller, ignoring the caller-supplied bucket value",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@budibase/server"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "3.38.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/Budibase/budibase/security/advisories/GHSA-xcx6-4f2g-hhgx"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/Budibase/budibase"
}, {
"type" : "WEB",
"url" : "https://github.com/Budibase/budibase/releases/tag/3.40.0"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-863" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-07-24T21:17:03Z",
"nvd_published_at" : null
}
}