Read the docs
TI-2026-39243 Aliases CVE-2026-54351GHSA-rgvg-3wpc-h44p

Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override

Priority HIGH 76CWE-915Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-915.

Summary

Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body into automation execution parameters. A mass assignment vulnerability in externalTrigger() allows an attacker to overwrite the internal appId property by including it in the webhook POST body. When the automation is processed asynchronously (the default path for webhooks without a collect step), the worker executes the attacker-defined automation in the context of the victim's workspace, granting full read/write access to the victim's database. This vulnerability is fixed in 3.39.9.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00461 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed budibase (Budibase): 3.39.9@budibase/server (npm): 3.39.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Budibasebudibasebefore 3.39.93.39.9Patch availableCNA
—@budibase/server (npm)before 3.39.93.39.9Patch availableGHSA-rgvg-3wpc-h44p
  • budibase VendorBudibase Affected before 3.39.9 Fixed in 3.39.9 Patch available CNA
  • @budibase/server (npm) Vendor— Affected before 3.39.9 Fixed in 3.39.9 Patch available GHSA-rgvg-3wpc-h44p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:*before 3.39.9VulnerableBudibase
  • cpe:2.3:a:budibase:budibase:*:*:*:*:*:*:*:* Versions before 3.39.9 Vulnerable ·Budibase

Remediation

  • Fix · CNA budibase (Budibase) Fixed in 3.39.9
  • Fix · GHSA-rgvg-3wpc-h44p @budibase/server (npm) Fixed in 3.39.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54351
  2. 2026-10-03 Alias added: GHSA-rgvg-3wpc-h44p

References

Exploit 1

Advisory 1

Other 1

  • TI-2026-39242 Budibase: Anonymous NoSQL operator injection via published-app query templates CVSS 3.1CRITICAL 10.0
  • TI-2026-24369 Budibase Universal Auth Bypass via Webhook Query Param Injection CVSS 3.1CRITICAL 9.1
  • TI-2026-39244 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload CVSS 3.1CRITICAL 9.6
  • TI-2026-24371 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist CVSS 3.1CRITICAL 9.9
  • TI-2026-23473 Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets CVSS 3.1CRITICAL 9.6
  • TI-2026-22078 Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud) CVSS 3.1CRITICAL 9.9
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences