Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override
Date: 2026-06
Affected: npm/@budibase/server
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-54351
CWE: CWE-915
CVSS: 8.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N)

## Summary The webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body into automation execution parameters. A mass assignment vulnerability in `externalTrigger()` allows an attacker to overwrite the internal `appId` property by including it in the webhook POST body. When the automation is processed asynchronously (the default path for webhooks without a collect step), the worker executes the attacker-defined automation in the context of the victim's workspace, granting full read/write access to the victim's database. ## Details The webhook trigger route is registered as a public endpoint with no authentication: ```typescript // packages/server/src/api/routes/webhook.ts:12 publicRoutes.post("/api/webhooks/trigger/:instance/:id", controller.trigger) ``` The controller passes the raw request body as `fields` alongside the server-derived `appId`: ```typescript // packages/server/src/api/controllers/webhook.ts:142-148 await triggers.externalTrigger(target, { fields: { ...ctx.request.body, // attacker-controlled body: ctx.request.body, }, appId: prodAppId, // server-controlled }) ``` In `externalTrigger()`, for webhook-triggered automations, `params.fields` is spread back into `params`: ```typescript // packages/server/src/automations/triggers.ts:237-241 params = { ...params, // appId: prodAppId (server-controlled) ...params.fields, // appId: VICTIM_ID (attacker-controlled, overwrites above) fi


Mitigations:

Architectural layers (MAESTRO):