[GHSA-jj36-r9w3-3pfh] Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials

[Amayyas]

Updates

• CWEs

Comments
This advisory currently has no CWE assigned. The corresponding CVE record,
CVE-2026-50136 (assigned by the GitHub CNA), classifies this vulnerability as
CWE-306: Missing Authentication for Critical Function.

This is consistent with the advisory's own description: the
POST /api/attachments/:datasourceId/url endpoint generates S3 presigned upload
URLs and "does not require authentication, table permission, datasource
permission, or builder access" — a critical function exposed without
authentication.

Adding CWE-306 aligns the GitHub Advisory Database entry with the published CVE
record and improves classification and filtering.

References:

• CVE-2026-50136 (NVD): https://nvd.nist.gov/vuln/detail/CVE-2026-50136
• Source advisory: GHSA-jj36-r9w3-3pfh

[github]

Hi there @mjashanks! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[advisory-database]

Hi @Amayyas! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!