01 Record

CVE-2026-72859

Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL

HighPUBLISHEDCNA: VulnCheck

Base score8.3 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

02 Description

Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL

Published: 2026-08-14 11:35Z5 HR AGO
Last updated: 2026-08-14 11:35Z5 HR AGO
Reserved: 2026-08-10
Assigning CNA: VulnCheck
Record state: PUBLISHED
Severity: High (CVSS 8.3)
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
Weaknesses: CWE-863
SSVC decision: No CISA-ADP assessment
Data version: 5.2
Document digest: e1274116cc0690d32366049e610dbf219de166d77f0c2ed59368aceed7748a70

VendorProductVersionsPlatforms

budibaseserver3.39.4 to < 3.40.0—

github.comGitHub Security Advisory (GHSA-xcx6-4f2g-hhgx)https://github.com/Budibase/budibase/security/advisories/GHSA-xcx6-4f2g-hhgxvendor-advisory
www.vulncheck.comVulnCheck Advisory: Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URLhttps://www.vulncheck.com/advisories/budibase-before-authorization-regression-via-s3-presigned-urlthird-party-advisory