Budibase is a low‑code platform that protects all server‑side APIs with an authorized() middleware. In versions 3.31.4 and earlier, the middleware can be bypassed by including a webhook pattern in the query string of any request. The isWebhookEndpoint() function uses an unanchored regular expression that evaluates the full URL, including query parameters. When the pattern matches, the middleware immediately calls next() and skips every authentication, role check, and CSRF protection. This flaw, a classic input validation weakness (CWE‑74), allows a remote, unauthenticated attacker to invoke any server‑side API simply by appending a string such as ?/webhooks/trigger to the URL.

Budibase v3.31.4 and earlier are affected. The vulnerable code resides in the Budibase server's authorized() middleware, which is part of all Budibase installations running these versions. No other vendors are listed in the CNA data.

With a CVSS base score of 9.1, the vulnerability qualifies as Critical. The EPSS score of 15% indicates that exploitation is currently more likely. The flaw is not yet listed in the KEV catalog. An attacker only needs network access to the Budibase server and the ability to construct a URL containing a webhook pattern; no authentication credentials are required. Once the URL is satisfied the request proceeds as if the user were fully authenticated, granting full access to any API endpoint and sensitive data.