# Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials

Unauthenticated Budibase endpoint signs S3 PutObject URLs with stored datasource credentials, letting anyone with workspace and datasource IDs write arbitrary objects.

- Payout: Research
- Severity: high
- Program: Budibase
- Found by: liyander, Amayyas
- Disclosed: 2026-06-22
- CVE: CVE-2026-50136
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-jj36-r9w3-3pfh
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-jj36-r9w3-3pfh
- Tags: area:cloud domain:cloud domain:web impact:integrity kind:research platform:ghsa sev:high tech:aws tech:s3 technique:source-review vuln:access-control vuln:auth-bypass vuln:misconfiguration

**Target:** POST /api/attachments/:datasourceId/url server route
**Root cause:** The static route registers the signed-upload-URL controller with only the recaptcha middleware, omitting authentication and datasource/table permission checks, then signs a PutObject URL using enriched datasource credentials with attacker-supplied bucket and key.
**Steps:**
1. Identify a workspace with an S3 datasource and obtain the workspace ID and S3 datasource ID.
2. Send unauthenticated `POST /api/attachments/<datasourceId>/url` with header `x-budibase-app-id: app_<workspace-id>` and body `{"bucket":"attacker-controlled-or-permitted-bucket","key":"poc/budibase.txt"}`.
3. Observe the response contains a signed PUT URL and publicUrl.
4. PUT harmless content to the returned signedUrl and confirm the object is created using the datasource's stored S3 credentials.
**How found:** Code review of the static route registration noticed only `recaptcha` was applied before `controller.getSignedUploadURL`, and the controller signs URLs from enriched datasource secrets using body-controlled bucket/key.
**Exploitation:** Attacker needs only a workspace ID and S3 datasource ID; the server loads the datasource with enriched secrets and returns a presigned PutObject URL for any bucket/key the credentials permit, enabling writes into trusted buckets, overwriting assets, or consuming storage under the org's cloud credentials.
**Insight:** Audit route registration middleware lists for endpoints that touch stored cloud credentials: a recaptcha-only guard on a controller that loads `{ enriched: true }` datasource secrets is a strong signal of missing authz.

## Proof of concept (copied exactly from the original report)

**Unauthenticated request generating signed S3 upload URL**

```
POST /api/attachments/<datasourceId>/url HTTP/1.1
x-budibase-app-id: app_<workspace-id>
content-type: application/json

{"bucket":"attacker-controlled-or-permitted-bucket","key":"poc/budibase.txt"}
```