Budibase Authorization Regression Enables Unauthorized S3 Access

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users hold by default. Attackers can specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket accessible by the stored IAM credentials, enabling unauthorized file uploads.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Budibase versions 3.39.4 through 3.40.0 contain a critical authorization flaw in the S3 attachment upload endpoint that permits BASIC users to generate presigned URLs for arbitrary S3 buckets. The vulnerability stems from a permission check regression that downgraded endpoint protection from BUILDER-level to TABLE/WRITE permissions, which BASIC users possess by default. This allows attackers to craft POST requests to the attachments endpoint and obtain write access to any S3 bucket accessible by the application's IAM credentials, effectively granting unauthorized cloud storage manipulation. Organizations running affected Budibase versions face immediate risk of data exfiltration, ransomware staging, and unauthorized cloud resource modification.

Casky's 283 mapped skills leverage Claude's extended reasoning to detect the attack patterns underlying TA0004 (Privilege Escalation) and TA0006 (Credential Access) techniques. Practitioners would observe findings that highlight: (1) unusual POST requests to attachments endpoints with S3 bucket parameters originating from low-privilege users; (2) presigned URL generation patterns that deviate from normal application behavior; (3) access attempts to S3 buckets outside the user's authorized scope; and (4) permission mismatches between user roles and endpoint protections. The AI-powered analysis correlates CWE-863 (Incorrect Authorization) signals with behavioral anomalies, enabling security teams to identify exploitation attempts before data reaches unauthorized cloud destinations.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-72859.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-72859

Casky has 283 skills that investigate the attack patterns behind CVE-2026-72859. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn