The vulnerability arises because the webhook schema-building endpoint is registered under builderRoutes, while the generic authorization middleware skips all paths matching /api/webhooks/schema. An unauthenticated caller can send requests to this endpoint to modify the body schema of an existing webhook and, through that, mutate the output schema of associated automation triggers. This change can alter the data processed by automated workflows, potentially leading to unexpected behavior or data leakage. The weakness is identified as CWE‑862.

Budibase low‑code platform versions earlier than 3.39.0 are affected. Administrators running Budibase at or before that release need to inspect whether any webhook or automation schemas have been unintentionally altered.

The CVSS score of 7.5 indicates high severity. EPSS data is not available, but the absence of an authentication requirement means exploitation is feasible on any publicly exposed Budibase instance. The risk is compounded by the potential to alter automated processes, which could impact business logic or data integrity. The vulnerability is not yet listed in CISA KEV, however the lack of that designation does not reduce the urgency of addressing it.