8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54351

CVE-2026-54351: Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override

Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body into automation execution parameters. A mass assignment vulnerability in externalTrigger() allows an attacker to overwrite the internal appId property by including it in the webhook POST body. When the automation is processed asynchronously (the default path for webhooks without a collect step), the worker executes the attacker-defined automation in the context of the victim's workspace, granting full read/write access to the victim's database. This vulnerability is fixed in 3.39.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54351

CVE-2026-54351:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@budibase/server	npm	< 3.39.9	3.39.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a mass assignment issue within the externalTrigger function in packages/server/src/automations/triggers.ts. When a webhook is triggered, the trigger controller in packages/server/src/api/controllers/webhook.ts passes the entire request body to the externalTrigger function. Inside externalTrigger, the properties of the request body are spread into an object that contains automation parameters. This allows an attacker to overwrite the appId parameter, which is supposed to be controlled by the server.

The modified parameters, including the attacker-controlled appId, are then added to an asynchronous job queue. The automation worker, specifically the doInAutomationContext function in packages/server/src/threads/automation.ts, processes this job. It uses the appId from the job data to set the workspace context for the automation. By providing the appId of a victim's workspace, an attacker can execute their own automations within the context of the victim's workspace, leading to unauthorized data access, modification, and code execution.

Vulnerable functions

externalTrigger

packages/server/src/automations/triggers.ts

This function is vulnerable to mass assignment. It spreads the user-controlled `params.fields` object into the `params` object after the server-controlled properties have been set. This allows an attacker to overwrite internal properties like `appId` by including them in the webhook POST body.

trigger

packages/server/src/api/controllers/webhook.ts

This function is the entry point for the webhook. It takes the raw HTTP request body from the user and passes it as `fields` to the `externalTrigger` function, which is vulnerable to mass assignment. This allows an attacker to inject malicious data.

doInAutomationContext

packages/server/src/threads/automation.ts

This function represents the asynchronous worker that executes the automation. It retrieves the `appId` from the job data, which is attacker-controlled due to the mass assignment vulnerability in `externalTrigger`. It then uses this `appId` to set the execution context, allowing the attacker's automation to run in the victim's workspace.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.