CVE-2026-54356

HighCVSS 7.1/10Last modified Sep 8, 2026

Description

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
Budibasebudibase< 3.41.3

References

Timeline

Published
Aug 17, 2026
Last modified
Sep 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-543575.1An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify user settings belongCVE-2026-543587.5An incorrect authorization vulnerability in MISP allows an organization administrator to target site administrator accounts belonging to theCVE-2026-543597.1MISP contains an insecure default configuration in which the Security.check_sec_fetch_site_header control is disabled. When this setting is CVE-2026-54368.1The MW WP Form plugin for WordPress is vulnerable to Arbitrary File Move/Read in all versions up to and including 5.1.1. This is due to insuCVE-2026-543608.4A mass assignment vulnerability exists in MISP’s sharing group creation endpoint. When creating a new sharing group, the controller did not CVE-2026-543618.8MISP contained multiple mass assignment vulnerabilities in the handling of collections, tag collections, event delegations, and shadow attriCVE-2026-543625.3An incorrect visibility condition in the MISP event template builder allowed authenticated non-site-admin users to view galaxies that shouldCVE-2026-543639.1CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypCVE-2026-543646.5CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary sessioCVE-2026-543657.5CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers tCVE-2026-543667.5CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arCVE-2026-543678.6CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbi