🚨High - Budibase Webhook Schema Endpoint Authorization Bypass (CVE-2026-48151) The webhook schema-building endpoint (POST /api/webhooks/schema/:instance/:id) is meant to be builder-only, but Budibase's authorization middleware skips auth for anything matching /api/webhooks/schema — treating it as a public webhook endpoint. The check runs before any user or permission validation. A remote, unauthenticated attacker who knows a workspace ID and webhook ID can update that webhook's body schema and mutate the linked automation's trigger output schema, corrupting builder-visible automation definitions and disrupting webhook-backed workflows. It's another entry in Budibase's recent run of webhook/auth-bypass issues. 👉Upgrade to Budibase 3.39.0.
Post summary
The text announces a high‑severity authorization bypass in Budibase’s webhook schema endpoint (CVE‑2026‑48151), details the technical flaw, and recommends upgrading to version 3.39.0 for remediation.
