CVE-2026-48151 Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema
Unauthenticated attackers can modify webhook and automation schemas in Budibase due to missing authorization checks on a specific API endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48151?
CVE-2026-48151 is a high-severity missing authorization vulnerability in budibase, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Budibase is an open-source low-code platform. Prior to 3.39.0, the webhook schema-building endpoint is registered under builderRoutes, but the generic authorization middleware skips authorization for all paths matching /api/webhooks/schema. As a result, an unauthenticated caller can update the body schema for a known webhook and mutate the corresponding automation trigger output schema. This vulnerability is fixed in 3.39.0.
Weakness: CWE-862
Which versions are affected by CVE-2026-48151?
2 open source packages ship an affected version, including @budibase/server.
| Package | Affected | Fixed in |
|---|---|---|
@budibase/server npm | All versions | 3.39.0 |
@budibase/server npm | All versions | 3.39.0 |
How do I fix CVE-2026-48151?
Upgrade @budibase/server to 3.39.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-48151 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48151 exists.
Sources
Also known as GHSA-qhv3-wjg8-6fx6.