Budibase webhook query-string pattern bypasses auth middleware on all server-side APIs (CVE-2026-31816)
CVE-2026-31816 reports a critical Budibase auth-bypass where adding a webhook-like path in the query string can skip authorization and CSRF checks on server APIs.
NewsAuthenticationWeb Security
09 Mar 2026