EUVD-2026-322422

fkie_cve-2026-48151

Budibase is an open-source low-code platform. Prior to 3.39.0, the webhook schema-building endpoint is registered under builderRoutes, but the generic authorization middleware skips authorization for all paths matching /api/webhooks/schema. As a result, an unauthenticated caller can update the body schema for a known webhook and mutate the corresponding automation trigger output schema. This vulnerability is fixed in 3.39.0.

GHSA-qhv3-wjg8-6fx6 — Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema

Affected: npm: @budibase/server

The webhook schema-building endpoint is registered under `builderRoutes`, but the generic authorization middleware skips authorization for all paths matching `/api/webhooks/schema`. As a result, an unauthenticated caller can update the body schema for a known webhook and mutate the corresponding automation trigger output schema.

### Details

The route appears to be builder-only:

- `packages/server/src/api/routes/webhook.ts:5-9`

```ts 5:builderRoutes 6: .get("/api/webhooks", controller.fetch) 7: .put("/api/webhooks", webhookValidator(), controller.save) 8: .delete("/api/webhooks/:id/:rev", controller.destroy) 9: .post("/api/webhooks/schema/:instance/:id", controller.buildSchema) ```

However, webhook endpoint detection explicitly includes `schema`:

- `packages/server/src/middleware/utils.ts:3-9`

```ts 3:const WEBHOOK_ENDPOINTS = new RegExp( 4: "^/api/webhooks/(trigger|schema|discord|ms-teams|slack)(/|$)" 5:) 6: 7:export function isWebhookEndpoint(ctx: UserCtx): boolean { 8: const path = ctx.path || ctx.request.url.split("?")[0] 9: return WEBHOOK_ENDPOINTS.test(path) ```

The authorization middleware bypasses all webhook endpoints before checking `ctx.user` or permissions:

- `packages/server/src/middleware/authorized.ts:90-99`

```ts 90: ) => 91: async (ctx: UserCtx, next: any) => { 92: // webhooks don't need authentication, each webhook unique 93: // also internal requests (between services) don't need authorized 94: if (isWebhookEndpoint(ctx) || ctx.i…

WID-SEC-W-2026-1629 — Budibase: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um Administratorrechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.

Most recent entries from all

EUVD-2026-322422

fkie_cve-2026-48151

GHSA-qhv3-wjg8-6fx6 — Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema

WID-SEC-W-2026-1629 — Budibase: Mehrere Schwachstellen