CVE-2026-54351

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.9

Description Budibase contains a mass assignment issue in the externalTrigger() function. The webhook trigger endpoint /api/webhooks/trigger/:instance/:id is publicly accessible and passes the full HTTP request body into automation execution parameters. An attacker can overwrite the internal appId property by including it in the POST body of the request. When automations are processed asynchronously, the worker executes the attacker-defined automation within the context of the victim's workspace. This allows an attacker with builder access to their own workspace to gain full read and write access to any other workspace's database on the same instance, provided they know the victim's workspace ID. Other overridable variables include timeout, user, and metadata.automationChainCount.

Recommendations Update Budibase to version 3.39.9. As a temporary mitigation, restrict access to the /api/webhooks/trigger/:instance/:id endpoint to trusted sources only.