CVE-2026-48151: Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema

Synopsis

This is an authorization bypass vulnerability in Budibase, an open-source low-code platform. The webhook schema-building endpoint incorrectly skips authentication checks for any request matching the path /api/webhooks/schema, making it reachable by anyone on the network without credentials. Successful exploitation lets an unauthenticated attacker overwrite the body schema of a known webhook and tamper with the corresponding automation trigger output schema, corrupting application logic and data pipelines. HarborGuard is tracking this advisory for patch availability, as no fixed image version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the Budibase instance.

• AuthenticationNot required

  The authorization middleware skips all credential checks for the affected path, so no account or token of any kind is needed.

• Victim interactionNot required

  The attacker sends requests directly to the endpoint and no action by a logged-in user is required to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free; the attacker only needs to know or guess a webhook identifier to target.

Blast Radius

• An attacker can overwrite the body schema of any webhook whose identifier is known or guessable, changing how incoming webhook payloads are parsed.
• Mutating the webhook schema propagates changes to the corresponding automation trigger output schema, corrupting the data passed into downstream automation steps.
• Automations that depend on the tampered schema may process malformed or attacker-controlled field mappings, potentially causing incorrect business logic execution.
• Integrity of the application configuration is damaged without leaving obvious access-log indicators, since the endpoint is treated as a public route by design.