7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48151

CVE-2026-48151: Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema

Budibase is an open-source low-code platform. Prior to 3.39.0, the webhook schema-building endpoint is registered under builderRoutes, but the generic authorization middleware skips authorization for all paths matching /api/webhooks/schema. As a result, an unauthenticated caller can update the body schema for a known webhook and mutate the corresponding automation trigger output schema. This vulnerability is fixed in 3.39.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48151

CVE-2026-48151:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@budibase/server	npm	< 3.39.0	3.39.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an authorization bypass that allows unauthenticated users to modify webhook and automation schemas. The root cause is in the isWebhookEndpoint function within packages/server/src/middleware/utils.ts. This function uses a regular expression to identify public webhook endpoints that do not require authentication. The regex ^/api/webhooks/(trigger|schema|discord|ms-teams|slack)(/|$) incorrectly includes /api/webhooks/schema, which is a sensitive endpoint intended only for authenticated builders.

The authorization middleware, located in packages/server/src/middleware/authorized.ts, relies on the isWebhookEndpoint function. When a request is made to /api/webhooks/schema, the middleware incorrectly identifies it as a public endpoint and skips authentication, passing the request to the next handler.

This allows the unauthenticated request to reach the buildSchema controller function in packages/server/src/api/controllers/webhook.ts. This function processes the request body and overwrites the bodySchema of the specified webhook, and can also modify the trigger schema of any associated automation. An attacker with knowledge of a valid webhook ID can therefore corrupt webhook and automation configurations, leading to disruption of service.

Vulnerable functions

buildSchema

packages/server/src/api/controllers/webhook.ts

This function is the controller for the `/api/webhooks/schema/:instance/:id` endpoint. It processes the incoming request and updates the webhook's `bodySchema` and the associated automation's trigger output schema. Due to the authorization bypass, this function can be executed by an unauthenticated attacker, allowing them to modify the schema of any known webhook.

isWebhookEndpoint

packages/server/src/middleware/utils.ts

This function is responsible for determining if a given request path belongs to a webhook endpoint. The vulnerability lies in the regular expression which incorrectly includes `schema` as a public webhook endpoint. This causes the authorization middleware to bypass authentication for the sensitive schema-building endpoint.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.