Executive brief
Budibase, an open-source low-code platform, contains a vulnerability that allows an attacker to execute automated tasks in another user's workspace. By sending a specially crafted request to a public webhook endpoint, an attacker can bypass security boundaries to read, modify, or delete data belonging to other organizations or tenants on the same server. This could lead to a complete compromise of sensitive customer databases and unauthorized access to internal environment variables.
Technical details
A mass assignment vulnerability exists in the `externalTrigger()` function within `packages/server/src/automations/triggers.ts`. The webhook trigger endpoint is publicly accessible and spreads the attacker-controlled HTTP request body into the automation execution parameters, allowing the `appId` property to be overwritten. When processed asynchronously (the default for webhooks without a 'collect' step), the worker uses the attacker-supplied `appId` to set the workspace context. An attacker with builder access to their own workspace can exploit this to execute arbitrary automations (including 'Execute Script' or 'Query Rows') against a victim's database, provided they know the victim's workspace ID. The issue is fixed in version 3.39.9 by ensuring `appId` is server-controlled before queuing.
Affected products
- Budibase budibase < 3.39.9
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published by Budibase
- 2026-06-26: disclosed: CVE published to NVD
- 2026-06-26: patched: Fix confirmed in version 3.39.9