CVE Intelligence
Analysis AI-assisted

CVE-2026-54351: Budibase Mass Assignment in Webhook Trigger Enabling Cross-Workspace Automation Execution

Budibase versions before 3.39.9 contain a mass assignment weakness (CWE-915) in the publicly reachable webhook trigger endpoint, where the full request body is passed into automation parameters. According to the record, an attacker can overwrite the internal appId property and have an asynchronously processed automation run in a victim's workspace. The vendor advisory describes the issue as fixed in 3.39.9.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Budibase is an open-source low-code platform. According to the advisory-derived record, its webhook trigger endpoint accepts the full HTTP request body and passes it into automation execution parameters. A mass assignment weakness (CWE-915) in the externalTrigger() path allows the internal appId property to be overwritten from the request body.

Impact

  • The record states that the automation can run in the context of the victim's workspace when processed asynchronously, which is described as the default path for webhooks without a collect step.
  • The record states this grants full read and write access to the victim's database.
  • The NVD base score is 9.6 (CVSS 3.1, vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). GitHub's score is 8.2. Both are listed in the record.

Affected products and versions

  • Budibase Budibase, versions earlier than 3.39.9.

Exploitation status

CISA KEV does not list this CVE. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00461 (percentile 0.38227), dated 2026-10-13.

Remediation and mitigation

  • Upgrade Budibase to version 3.39.9 or later, as indicated by the vendor advisory.
  • Review the vendor advisory for the mitigation guidance listed in the record.
  • Review automations triggered by webhooks and confirm which workspaces they can affect.

Detection guidance

  • Review webhook trigger logs for unexpected requests to externalTrigger-related endpoints, especially requests whose body includes workspace-identifying fields.
  • Monitor for automations executing in workspaces that do not match the expected source of the webhook.

Limitations of the available information

  • The record does not include a detailed technical write-up beyond the description, so exact request conditions are unknown.
  • The title in the record is null; the title here is derived from the description.
  • The record does not state whether patches for older branches exist.

Frequently asked questions

Which Budibase versions are affected by CVE-2026-54351?

The record lists Budibase versions earlier than 3.39.9 as affected. The vendor advisory describes the issue as fixed in 3.39.9.

Is this vulnerability known to be actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted.

What is the severity score?

NVD assigns a CVSS 3.1 base score of 9.6, and GitHub assigns 8.2, according to the record.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.