Budibase, an open‑source low‑code platform, contains a mass‑assignment flaw in the externalTrigger() function that processes webhook POST requests. Because the public webhook trigger endpoint includes the entire HTTP request body in automation parameters, an attacker can supply an appId field in the payload. This overwrites the internal appId, causing the automation to run asynchronously in the victim workspace’s context. The outcome is that the attacker‑defined automation executes with full read and write privileges to the workspace’s database. The weakness is a classic mass assignment issue (CWE‑915) that enables remote code or database manipulation without authentication.

Any instance of Budibase earlier than version 3.39.9 is vulnerable. The affected product is Budibase, specifically the webhook trigger endpoint that accepts externalTrigger() calls. The fix is included in release 3.39.9 and later.

With a CVSS of 8.2 the vulnerability is classified as high severity. The EPSS score is not available, but the absence of a KEV listing indicates no publicly known exploitation yet. The likely attack vector is a public HTTP POST to the webhook trigger endpoint, which an attacker can reach if the endpoint is exposed over the internet. If the endpoint is reachable and an attacker can craft the payload, the exploit is straightforward and requires no additional credentials. Consequently, organizations running Budibase sites that expose this endpoint must prioritize remediation.