{"id":"GHSA-qhv3-wjg8-6fx6","summary":"Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema","details":"The webhook schema-building endpoint is registered under `builderRoutes`, but the generic authorization middleware skips authorization for all paths matching `/api/webhooks/schema`. As a result, an unauthenticated caller can update the body schema for a known webhook and mutate the corresponding automation trigger output schema.\n\n### Details\n\nThe route appears to be builder-only:\n\n- `packages/server/src/api/routes/webhook.ts:5-9`\n\n```ts\n5:builderRoutes\n6:  .get(\"/api/webhooks\", controller.fetch)\n7:  .put(\"/api/webhooks\", webhookValidator(), controller.save)\n8:  .delete(\"/api/webhooks/:id/:rev\", controller.destroy)\n9:  .post(\"/api/webhooks/schema/:instance/:id\", controller.buildSchema)\n```\n\nHowever, webhook endpoint detection explicitly includes `schema`:\n\n- `packages/server/src/middleware/utils.ts:3-9`\n\n```ts\n3:const WEBHOOK_ENDPOINTS = new RegExp(\n4:  \"^/api/webhooks/(trigger|schema|discord|ms-teams|slack)(/|$)\"\n5:)\n6:\n7:export function isWebhookEndpoint(ctx: UserCtx): boolean {\n8:  const path = ctx.path || ctx.request.url.split(\"?\")[0]\n9:  return WEBHOOK_ENDPOINTS.test(path)\n```\n\nThe authorization middleware bypasses all webhook endpoints before checking `ctx.user` or permissions:\n\n- `packages/server/src/middleware/authorized.ts:90-99`\n\n```ts\n90:  ) =\u003e\n91:  async (ctx: UserCtx, next: any) =\u003e {\n92:    // webhooks don't need authentication, each webhook unique\n93:    // also internal requests (between services) don't need authorized\n94:    if (isWebhookEndpoint(ctx) || ctx.internal) {\n95:      return next()\n96:    }\n97:\n98:    if (!ctx.user) {\n99:      return ctx.throw(401, \"No user info found\")\n```\n\nThe bypassed controller writes attacker-derived schema data to the webhook and automation trigger outputs:\n\n- `packages/server/src/api/controllers/webhook.ts:56-83`\n\n```ts\n56:export async function buildSchema(\n57:  ctx: Ctx\u003cBuildWebhookSchemaRequest, BuildWebhookSchemaResponse\u003e\n58:) {\n59:  await context.doInWorkspaceContext(ctx.params.instance, async () =\u003e {\n60:    const db = context.getWorkspaceDB()\n61:    const webhook = await db.get\u003cWebhook\u003e(ctx.params.id)\n62:    webhook.bodySchema = toJsonSchema(ctx.request.body)\n63:    // update the automation outputs\n64:    if (webhook.action.type === WebhookActionType.AUTOMATION) {\n65:      let automation = await db.get\u003cAutomation\u003e(webhook.action.target)\n66:      const autoOutputs = automation.definition.trigger.schema.outputs\n67:      let properties = webhook.bodySchema?.properties\n68:      // reset webhook outputs\n69:      autoOutputs.properties = {\n70:        body: autoOutputs.properties.body,\n71:      }\n72:      for (let prop of Object.keys(properties || {})) {\n73:        if (properties?.[prop] == null) {\n74:          continue\n75:        }\n76:        const def = properties[prop]\n77:        if (typeof def === \"boolean\") {\n78:          continue\n79:        }\n80:        autoOutputs.properties[prop] = {\n81:          type: def.type as AutomationIOType,\n82:          description: AUTOMATION_DESCRIPTION,\n83:        }\n```\n\nThe route grouping suggests builder authorization was intended, but the global webhook bypass removes it.\n\n### PoC\n\nNon-destructive validation approach:\n\n1. Create a webhook-backed automation as a builder.\n2. Record the workspace ID and webhook ID.\n3. Log out or send no auth headers.\n4. Send:\n\n```http\nPOST /api/webhooks/schema/\u003cworkspaceId\u003e/\u003cwebhookId\u003e HTTP/1.1\ncontent-type: application/json\n\n{\"unauth_schema_probe\":\"test\"}\n```\n\n5. Fetch the webhook as a builder and observe that `bodySchema` has changed.\n6. For automation-backed webhooks, inspect the automation trigger schema outputs and observe that properties were reset/updated.\n\n### Impact\n\nAn unauthenticated attacker can modify webhook schema metadata and automation trigger output schema for known webhook IDs. This can corrupt builder-visible automation definitions, alter downstream binding behavior, and disrupt webhook-backed automation workflows.","aliases":["CVE-2026-48151"],"modified":"2026-09-10T03:50:50.242075225Z","published":"2026-06-12T18:28:34Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-06-12T18:28:34Z","nvd_published_at":"2026-05-27T18:16:27Z","cwe_ids":["CWE-862"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/Budibase/budibase/security/advisories/GHSA-qhv3-wjg8-6fx6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48151"},{"type":"PACKAGE","url":"https://github.com/Budibase/budibase"}],"affected":[{"package":{"name":"@budibase/server","ecosystem":"npm","purl":"pkg:npm/%40budibase/server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.39.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-qhv3-wjg8-6fx6/GHSA-qhv3-wjg8-6fx6.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}