Executive brief
Budibase is a low-code platform used to build internal business applications. A security flaw in its webhook management system allows unauthorized individuals to modify the data structure (schema) of existing webhooks and automation triggers. This could lead to corrupted application logic, broken business workflows, and incorrect data processing within the platform.
Technical details
A vulnerability exists in Budibase where the webhook schema-building endpoint (`/api/webhooks/schema/:instance/:id`) is incorrectly exempted from authorization checks. While intended for builders, the `isWebhookEndpoint` middleware uses a regular expression that includes the 'schema' path, causing the `authorized` middleware to skip authentication for these requests. An unauthenticated attacker with knowledge of a workspace and webhook ID can send a POST request to this endpoint to overwrite the `bodySchema` and mutate corresponding automation trigger output schemas. This results in the corruption of automation definitions and downstream data bindings. The issue is fixed in version 3.39.0.
Affected products
- Budibase @budibase/server < 3.39.0
Timeline
- 2026-05-21: disclosed: Initial disclosure by researcher
- 2026-05-27: advisory: NVD publication date
- 2026-06-12: patched: GitHub Advisory published and reviewed