VYPR
← All advisories
High severity7.5NVD Advisory· Published May 27, 2026· Updated May 28, 2026

CVE-2026-48151

CVE-2026-48151

Description

Budibase is an open-source low-code platform. Prior to 3.39.0, the webhook schema-building endpoint is registered under builderRoutes, but the generic authorization middleware skips authorization for all paths matching /api/webhooks/schema. As a result, an unauthenticated caller can update the body schema for a known webhook and mutate the corresponding automation trigger output schema. This vulnerability is fixed in 3.39.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@budibase/servernpm
< 3.39.03.39.0

Affected products

2
  • Budibase/Budibaseinferred2 versions
    <3.39.0+ 1 more
    • (no CPE)range: <3.39.0
    • (no CPE)range: <3.39.0

Patches

Vulnerability mechanics

References

3

News mentions

1