CVE-2026-72849

Received Received - Intake

CSRF in Budibase Chat-Link Handoff Endpoint

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user's account, enabling impersonation within agent operations and inheritance of victim permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72849

EUVD

EUVD-2026-58500

Affected Vendors & Products

Vendor	Product	Version / Range
budibase	budibase	to 3.40.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Budibase before version 3.40.0 has a cross-site request forgery (CSRF) vulnerability in the chat-link handoff endpoint. This flaw allows attackers to bind an external chat identity to a victim's account by tricking them into visiting a malicious page that auto-submits a POST request with a leaked confirmation token. The attacker can then impersonate the victim in agent operations and inherit their permissions.

Detection Guidance

Detection involves monitoring for unusual POST requests to the chat-link handoff endpoint or unexpected chat identity bindings. Check server logs for POST requests to /api/chat-link/handoff with confirmation tokens not initiated by users. Look for suspicious activity where external chat identities are linked to user accounts without user action.

Impact Analysis

If you use Budibase before 3.40.0, an attacker could trick you into clicking a malicious link, allowing them to bind their chat identity to your account. This could lead to unauthorized actions performed under your identity, potential data exposure, or misuse of your permissions within the system.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using vulnerable Budibase versions risk non-compliance due to potential unauthorized data exposure or misuse.

Mitigation Strategies

Upgrade Budibase to version 3.40.0 or later to address the vulnerability. Implement CSRF tokens for all state-changing requests. Review and revoke any unauthorized chat identity bindings in user accounts. Monitor for and remove any suspicious linked chat identities.

Hi! I’m here to help you understand CVE-2026-72849. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70