An authorization regression in Budibase server versions 3.39.4 to 3.40.0 allows authenticated users to bypass security controls.

This is an incorrect authorization vulnerability (CWE-863) where the application fails to properly validate permissions before granting access to resources via S3 presigned URLs.

The vulnerability allows an authenticated attacker to perform unauthorized actions, potentially compromising the integrity of data stored in S3 buckets. With a CVSS score of 7.7, the risk of unauthorized data modification or access is significant for business operations relying on Budibase.

Immediate Action: Upgrade to Budibase server version 3.40.0 or later to resolve the authorization regression.

Proactive Monitoring: Review access logs for unusual patterns of S3 resource access that deviate from normal user workflow behavior.

Compensating Controls: Temporarily restrict access to S3-related features if upgrading is not immediately possible, or implement strict IAM policies on the S3 buckets to limit accessible scope.

Public Exploit Available: No (no confirmed weaponized exploit or public PoC identified).

Administrators should treat this as a high-priority update. Upgrading to version 3.40.0 is the definitive fix to restore proper authorization checks and prevent potential unauthorized data manipulation.