Budibase is an open-source low-code platform. Prior to 3.39.0, the webhook schema-building endpoint is registered under builderRoutes, but the generic authoriza…

Budibase open-source low-code platform contains an authorization bypass vulnerability in versions prior to 3.39.0. The webhook schema-building endpoint is registered under builderRoutes but the authorization middleware incorrectly skips authorization for paths matching /api/webhooks/schema. This allows unauthenticated attackers to update webhook body schemas and mutate automation trigger output schemas. The vulnerability has been patched in version 3.39.0.