CVE-2026-72859

Executive Summary

CVE-2026-72859 is a high-severity authorization regression in Budibase, a self-hosted low-code application platform, affecting versions 3.39.4 through 3.39.x (fixed in 3.40.0). A permission check on the S3 attachment upload endpoint was unintentionally downgraded from a BUILDER role check to a TABLE/WRITE check, which BASIC users hold by default, allowing any low-privileged authenticated user to obtain S3 PutObject presigned URLs. Successful exploitation enables unauthorized writes to any S3 bucket accessible by the IAM credentials configured on the Budibase server, with a CVSS score of 7.7 (High) and no known public exploit or in-the-wild activity as of writing.

Technical Analysis

The root cause of CVE-2026-72859 is an incorrect authorization control (CWE-863), introduced as a regression during development of the S3 attachment upload feature. According to the NVD description, the endpoint responsible for generating attachment upload URLs previously enforced a BUILDER permission check. At some point in the affected version range, this check was changed to a TABLE/WRITE permission check. In Budibase's default role model, BASIC users hold TABLE/WRITE permissions, meaning the lowest-privileged default role can now invoke an operation that was designed to be restricted to BUILDER-level users.

The endpoint accepts HTTP POST requests and, critically, allows the client to specify an arbitrary S3 bucket in the request body. Upon receiving a valid request, the server-side code path generates a presigned URL for the S3 PutObject operation, signed using the IAM credentials stored in the Budibase deployment's storage configuration. Presigned URLs are time-limited write tokens: anyone in possession of one can upload an object to the target bucket without possessing the underlying IAM credentials. Because the bucket name is attacker-controlled and validated only against the (weakened) TABLE/WRITE permission, the attacker is not constrained to the browser/attachment bucket the tenant actually owns. Any bucket that the IAM principal can write to is in scope.

Several properties of this vulnerability are notable from a technical perspective:

• Attack complexity is low. No special conditions, race windows, or user interaction are required; the only precondition is an authenticated session with BASIC privileges.
• The impact is integrity-only. The attacker can write/overwrite S3 objects but cannot read objects using this flaw (no confidentiality impact). The CVSS vector reflects this: C:N/I:H/A:N.
• The scope is changed (S:C). The vulnerable component (Budibase application layer) resides in an authorization scope that is separate from the target resource (S3 buckets, which live in the cloud storage provider's identity domain). This scope change is what elevates the severity to 7.7 despite the low privilege requirement.
• The IAM blast radius is deployment-dependent. The actual impact is bounded by the permissions of the IAM role or access key configured for Budibase's S3 integration. A tightly scoped role limited to a single bucket/prefix minimizes impact; a broadly scoped role with s3:* actions across many buckets can produce significant integrity damage.

The affected version range is described as "3.39.4 before 3.40.0," implying the regression was introduced in 3.39.4 and remediated in 3.40.0. Patch confidence is low (2/4): the fix is claimed by a single OSV source and has not been independently confirmed by vendor documentation or duplicate analysis. Deployment architectures using object storage backends other than S3 (e.g., MinIO or S3-compatible storage) are likely affected in the same manner, since the presigned URL mechanism is the same.

Exploitation Scenarios

No public proof-of-concept or exploit code has been identified for CVE-2026-72859 at the time of writing. The attack chain below is inferred strictly from the vulnerability class and the NVD description.

Step 1 — Reconnaissance / target identification. The attacker identifies an internet-facing Budibase instance, for example via HTTP fingerprinting (login page title, X-Powered-By headers, or distinctive JavaScript/CSS assets associated with Budibase). The attacker confirms the instance uses an S3-compatible attachment backend — this may be observable from product documentation, error messages, or the presence of attachment/upload features exposed in the UI. The attacker then obtains a valid BASIC-level account. Depending on deployment policy, this may be achieved via default credentials, credential stuffing, phishing, or — in configurations where self-registration is enabled — by simply creating an account.

Step 2 — Triggering the authorization flaw. Using the BASIC account session, the attacker sends a specially crafted HTTP POST request to the S3 attachment upload endpoint. The request body specifies a target S3 bucket chosen by the attacker. Because the route's permission check was regressed from BUILDER to TABLE/WRITE, the request passes authorization checks. No BUILDER privileges are required.

Step 3 — Generation of the presigned URL. The server executes the attachment upload code path and generates an S3 PutObject presigned URL, signed with the deployment's stored IAM credentials. The URL is returned to the attacker in the HTTP response. At this point, the attacker does not need the IAM credentials themselves — the presigned URL embeds the necessary signature.

Step 4 — Post-exploitation. The attacker uses the issued presigned URL to upload arbitrary content to the target bucket. Realistic impact scenarios include:

• Uploading HTML/JavaScript files to a public S3-hosted website, defacing it or planting credential-harvesting pages.
• Planting malicious objects (e.g., executables, documents, or scripts) that are later downloaded by downstream users of applications consuming data from the bucket (a poisoning/supply-chain style attack).
• Overwriting existing objects, corrupting data sets, backups, or configuration files stored in the bucket.
• If the IAM credentials have cross-account or federation write permissions, the attacker can propagate the integrity violation into other AWS accounts or services.

Because the presigned URL is time-limited and often object-key-specific, the attacker may repeat the POST request to obtain new URLs for multiple object keys, effectively gaining broad write access to any bucket the IAM principal can reach.

Impact Assessment

The CVSS 3.1 base score is 7.7 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C:C:N/I:H/A:N.

• Attack Vector (AV:N): The endpoint is reachable over the network.
• Attack Complexity (AC:L): No special conditions beyond authentication.
• Privileges Required (PR:L): Only BASIC-level access, which is the default low-privilege role.
• User Interaction (UI:N): None.
• Scope (S:C): The impact target (S3 buckets) is in a different authorization scope than the vulnerable component (Budibase application), which meaningfully increases severity.
• Confidentiality (C:N): The flaw does not disclose data; presigned URLs generated are write-only (PutObject).
• Integrity (I:H): Unauthorized creation and overwriting of objects in S3 buckets is a total loss of data-integrity for affected objects.
• Availability (A:N): No direct availability impact, although attackers could attempt to exhaust storage quotas or overwrite critical objects in a way that indirectly degrades service.

Business impact. Organizations running affected Budibase versions with S3 attachment storage face integrity compromise of their object stores. This can translate into defacement of public-facing assets, distribution of malicious content to end users, corruption of application data, and failure of compliance obligations that require demonstrable integrity controls (e.g., tamper-evident audit data, financial records). The scope change means the integrity impact can extend beyond the Budibase application itself into other workloads sharing the same IAM credentials.

Affected systems. Budibase versions 3.39.4 through 3.39.x, specifically deployments where the S3 attachment upload feature is enabled and the associated IAM role has write access to more than the single intended tenant bucket.

Blast radius. Determined entirely by the IAM role's effective write permissions. Deployments that followed least-privilege guidance (single bucket, prefixed key constraints) face limited impact; deployments using wide-scoped roles or shared/centralized storage accounts face significantly broader exposure.

Threat landscape. CVE-2026-72859 is not listed in CISA KEV, no exploit code has been publicly released, and no threat-actor campaigns were identified as of writing. EPSS has not yet been scored by FIRST.org, so no likelihood-of-exploitation data is available.

Detection Guidance

Detection of this vulnerability in the wild should focus on two observable artifacts:

1. Low-privileged (non-BUILDER) sessions issuing POST requests to attachment-related endpoints. This is the first half of the exploit chain.
2. HTTP responses containing S3 presigned URL signature parameters. Presigned URLs for AWS S3 use SigV4 query authentication and contain distinctive markers such as X-Amz-Signature= and amazonaws.com. The appearance of such a URL in the response body to a POST request is a strong indicator that a presigned URL was generated and returned to the client.

The rules below assume web server, reverse proxy, or WAF logs include HTTP method, request URI, and — where possible — response body content. Field names should be adapted to the local logging schema.

Sigma Rule

title: Budibase S3 Attachment Upload Authorization Bypass - CVE-2026-72859
id: 33d1a7c2-b60d-4f9e-8a53-1f2c91d4b6e0
status: experimental
description: Detects HTTP POST requests to a Budibase S3 attachment upload endpoint that elicit a response containing AWS S3 presigned URL signature parameters. Consistent with CVE-2026-72859, where BASIC users obtain PutObject presigned URLs for arbitrary S3 buckets.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-72859
    - https://cwe.mitre.org/data/definitions/863.html
author: Valtersit Threat Intelligence
date: 2026/05/26
tags:
    - attack.t1190
    - attack.initial_access
    - cve.2026-72859
    - cwe.863
logsource:
    category: webserver
    product: generic
    definition: Requires web server or reverse proxy logs containing HTTP method, request URI, and response body (or WAF/API-gateway logs with response payload capture).
detection:
    selection_method:
        http.method: POST
    selection_uri:
        http.url|contains: attachment
    selection_response:
        http.response.body|contains|all:
            - 'amazonaws.com'
            - 'X-Amz-Signature='
    condition: selection_method and selection_uri and selection_response
falsepositives:
    - Legitimate attachment uploads performed by authorized BUILDER/admin users when the logging layer captures response bodies.
    - Non-Budibase applications that also use S3 presigned URLs and include the string 'attachment' in their URI.
level: high

YARA Rule

/*
    YARA rule for CVE-2026-72859 (Budibase S3 presigned URL authorization bypass).
    Use against aggregate log files, HTTP traffic captures, or forensic artifacts to
    identify S3 presigned URL markers consistent with the vulnerability's exploitation.
*/
rule CVE_2026_72859_Budibase_S3_PresignedURL {
    meta:
        author      = "Valtersit Threat Intelligence"
        description = "Detects artifacts containing S3 presigned URL signature parameters consistent with CVE-2026-72859 unauthorized upload flow"
        cve         = "2026-72859"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-72859"
        date        = "2026-05-26"
        score       = 60

    strings:
        $sig_v4    = "X-Amz-Signature=" ascii wide nocase
        $cred      = "X-Amz-Credential=" ascii wide nocase
        $aws_ep    = "amazonaws.com" ascii wide nocase
        $s3_prefix = "s3." ascii wide nocase
        $post_m    = "POST" ascii wide
        $att_path  = "attachment" ascii wide nocase
        $put_op    = "PutObject" ascii wide nocase

    condition:
        ( all of ($sig_v4, $cred) and any of ($aws_ep, $s3_prefix) ) or
        ( $att_path and $post_m and all of ($sig_v4, $cred) )
}

Suricata IDS Rule

alert http any any -> any any ( \
    msg:"CVE-2026-72859 Budibase S3 attachment upload authorization bypass - presigned URL returned in response"; \
    flow:established; \
    http.method; content:"POST"; \
    http.request_uri; content:"attachment"; nocase; \
    http.response_body; content:"X-Amz-Signature="; nocase; \
    http.response_body; content:"amazonaws.com"; nocase; \
    classtype:attempted-admin; \
    sid:202672859; rev:1; \
    metadata:cve [CVE-2026-72859]; \
    metadata:created_at 2026_05_26; )

Note: this rule may generate false positives if the deployment legitimately uses S3 presigned URLs and logs response bodies. Tune by excluding BUILDER/admin source IP ranges or by adding a correlation that the requesting session belongs to a low-privileged role.

Elastic Detection

/*
 * EQL detection for CVE-2026-72859.
 * Runtime is the sequence of an HTTP POST to an attachment endpoint followed by a
 * 200-response containing S3 presigned URL signature markers.
 * Requires HTTP fields indexed from Packetbeat, Filebeat (ECS), or a similar pipeline.
 */
sequence by source.ip with maxspan=15s
  [ http where
      http.request.method == "POST" and
      http.request.uri like "*attachment*"
  ]
  [ http where
      http.response.status_code == 200 and
      http.response.body like "*X-Amz-Signature=*" and
      http.response.body like "*amazonaws.com*"
  ]

Splunk SPL Query

(index=*web* OR index=*proxy* OR index=*http*) method=POST uri="*attachment*"
| rex field=response_body "(?<presigned_sig>X-Amz-Signature=[a-fA-F0-9]{32,})"
| rex field=response_body "(?<bucket_url>https://[a-zA-Z0-9.\-]+\.s3\.[a-z0-9\-]+\.amazonaws\.com[^\"']*)"
| where isnotnull(presigned_sig)
| stats count earliest(_time) latest(_time) values(bucket_url) values(uri) by src_ip, user, host
| sort - count

If response-body logging is unavailable, fall back to detecting POST requests to attachment endpoints from accounts identified as BASIC role, correlated with subsequent CloudTrail PutObject events from the Budibase IAM identity to unexpected buckets.

Wazuh OSSEC Rule

<group name="web,budibase,">
    <rule id="120285" level="12">
        <decoded_as>json</decoded_as>
        <field name="http.method" type="pcre2">^POST$</field>
        <field name="http.url" type="pcre2">attachment</field>
        <field name="http.response.body" type="pcre2">X-Amz-Signature=</field>
        <description>CVE-2026-72859: Budibase S3 attachment upload authorization bypass — presigned URL returned to requester</description>
        <group>cve_2026_72859,budibase_s3_bypass,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED). The fix is claimed solely by an OSV source and has not been independently confirmed in vendor release notes. The NVD description indicates the flaw exists in versions before 3.40.0, which implies the fix is incorporated in that release, but organizations should verify the actual permission-check behavior after upgrading.

1. Immediate mitigations

   • Upgrade all Budibase instances to version 3.40.0 or later as soon as possible. If the fix is confirmed, this fully restores the BUILDER permission check on the S3 attachment upload endpoint.
   • If an immediate upgrade is not possible, restrict access to the attachment endpoint using a reverse proxy or WAF rule that only permits requests from administrative/BUILDER source IPs or requiring additional authentication headers.
   • Review and tighten the IAM role/credentials used by Budibase for S3 access. Remove write access to all buckets except the specific bucket(s) and key prefixes required for tenant attachments. Apply bucket policies with explicit Deny for all other buckets where feasible.
   • Audit AWS CloudTrail for PutObject events generated by the Budibase IAM identity targeting unexpected buckets. If suspicious activity is found, rotate the IAM access keys immediately.
   • Temporarily disable the S3 attachment upload feature if the business can operate without it during the upgrade window.

2. Patch / upgrade steps

   • Download Budibase 3.40.0 from the official vendor release channel.
   • Back up the application database and configuration before upgrading.
   • Perform the upgrade in a staging environment first; verify that the attachment upload endpoint now enforces BUILDER permission by testing with a BASIC-role account.
   • Deploy to production and re-verify the permission check. Confirm via the OSV advisory and vendor changelog that the fix addresses CVE-2026-72859 specifically.

3. Long-term hardening

   • Enforce least privilege on all IAM roles used by Budibase and any other self-hosted application: scope actions to specific buckets, prefix paths, and required API actions (s3:PutObject, not s3:*).
   • Implement server-side allow-listing of S3 bucket names: the endpoint should reject any request whose bucket is not in the tenant's configured bucket list, independent of the role-based permission check.
   • Add regression tests to CI/CD pipelines that assert permission boundaries — e.g., automated tests confirming that BASIC-role sessions cannot reach endpoints designed for BUILDER-only access.
   • Subscribe to OSV and vendor security advisories for Budibase, and integrate CVE/EPSS feeds into the vulnerability management program for tracking CVE-2026-72859 (EPSS is not yet scored; re-evaluate once available).
   • Maintain continuous monitoring of S3 CloudTrail logs and web access logs to detect anomalous attachment-upload behavior.

References

1. NVD — CVE-2026-72859: https://nvd.nist.gov/vuln/detail/CVE-2026-72859
2. OSV — CVE-2026-72859 (patch claim source; commit 54b592e50af8cde47a815e6fe458e24be66a1c3a): https://osv.dev/vulnerability/CVE-2026-72859
3. CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
4. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. Budibase official project / release channel: https://github.com/Budibase/budibase

No known threat-actor campaigns or exploit-in-the-wild evidence has been identified for CVE-2026-72859. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. EPSS has not yet been scored by FIRST.org; any EPSS value presented elsewhere should be treated as unverified.