CVE-2026-54351: Budibase Webhook Mass Assignment Vulnerability (CVSS 8.2)

Technical summary

The vulnerability exists in the externalTrigger() function within Budibase's webhook handling mechanism. The endpoint accepts POST requests and passes the entire HTTP request body into automation execution parameters without sanitization. A mass assignment flaw allows an attacker to inject an appId property into the webhook body, overwriting the legitimate application context. When the automation is processed asynchronously (the default behavior for webhooks without a collect step), the worker executes the attacker-controlled automation using the hijacked appId, effectively running the attacker's logic within the victim's workspace authentication context. CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) describes this class of vulnerability where object properties are modified through unsanitized user input.

Business impact

An attacker with valid authentication credentials can access and modify sensitive data across an entire workspace's database. This includes potential exfiltration of confidential records, unauthorized modification or deletion of business-critical data, and disruption of automated workflows. For organizations using Budibase to manage customer data, internal records, or operational workflows, this vulnerability could expose regulated information and breach compliance obligations. The risk is amplified in multi-tenant deployments where workspace isolation is a core security assumption.

Affected systems

Budibase versions prior to 3.39.9 are vulnerable. The open-source low-code platform is affected across all deployments—whether self-hosted or cloud-based—that run unpatched versions. The vulnerability requires the attacker to already possess valid authentication credentials to craft and send the malicious webhook request, limiting the initial attack surface to internal or trusted users with platform access.

Exploitability

Exploitation requires an authenticated user (PR:L in the CVSS vector) but does not require user interaction. The attack complexity is rated as HIGH, likely due to the need to understand the application's internal appId structure and successfully craft a webhook payload that reaches asynchronous processing. However, once an attacker grasps the mechanics, the exploit is straightforward: send a POST request to a known webhook endpoint with a manipulated body. Public documentation and typical webhook patterns may make this feasible for determined attackers. The vulnerability is not currently listed in the Known Exploited Vulnerabilities (KEV) catalog, though this does not indicate real-world exploitation has not occurred.

Remediation

Organizations must immediately upgrade Budibase to version 3.39.9 or later. The patch address the mass assignment vulnerability by implementing proper input validation and sanitization in the webhook trigger handler, ensuring that user-supplied request bodies cannot overwrite critical internal properties like appId. Review webhook configurations and audit logs for any suspicious webhook activity or unauthorized automation executions prior to patching. Consider temporarily disabling webhooks in sensitive deployments until the patch is applied if forensic investigation is required.

Patch guidance

Upgrade Budibase to version 3.39.9 or later. Consult the official Budibase release notes and security advisories for any breaking changes or migration guidance associated with the patch. For self-hosted instances, verify the upgrade path through the Budibase documentation to ensure minimal disruption. Cloud-hosted customers should confirm patch deployment status with their service provider. After patching, restart all worker processes to ensure the new code is active, as the vulnerability is triggered during asynchronous automation execution.

Detection guidance

Examine webhook logs and automation execution records for anomalous appId values or automations executed under unexpected application contexts. Look for POST requests to webhook endpoints that include appId in the request body—legitimate webhook payloads typically do not contain this parameter. Monitor workspace database access logs for unauthorized read/write operations correlating with webhook triggers. Set up alerts for automation executions initiated via webhooks that target data outside the expected application scope. Forensic analysis may reveal attacker-controlled automation names or actions that differ from intentionally configured workflows.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (8.2) and the severity of the impact: unrestricted read/write access to an entire workspace's database. Although exploitation requires prior authentication, the ability for an insider or compromised account to escalate privileges and exfiltrate or sabotage data makes this a critical control gap. The default asynchronous webhook processing means most configurations are vulnerable by default. The six-day window between publication and the latest modification suggests active vendor engagement, but the lack of KEV listing should not delay organizational response.

Risk score, explained

The CVSS:3.1 score of 8.2 (HIGH) reflects a network-accessible vulnerability with significant impact on confidentiality and integrity. The 'High' complexity factor accounts for the attacker's need to understand internal appId mechanics and craft a valid payload. The 'Low' privilege requirement acknowledges that authentication is necessary, reducing the threat surface compared to unauthenticated vulnerabilities. The 'Changed' scope indicates that the vulnerability affects resources beyond the security scope of the vulnerable component—the attacker gains access to other applications and data within the same workspace. The absence of availability impact (CIA: C=H, I=H, A=N) reflects that the vulnerability enables data access and modification but not denial of service, though data deletion remains a concern under the integrity impact rating.

Frequently asked questions