CVE-2026-72849 in Budibase
Summary
by MITRE • 08/14/2026
Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user's account, enabling impersonation within agent operations and inheritance of victim permissions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
This cross-site request forgery vulnerability in Budibase versions prior to 3.40.0 represents a critical security flaw that undermines the integrity of user authentication and authorization mechanisms. The vulnerability specifically affects the chat-link handoff endpoint, which serves as a bridge between external chat services and the application's user management system. The flaw allows attackers to exploit the lack of proper CSRF protection mechanisms, enabling them to perform unauthorized actions on behalf of victims without their knowledge or consent.
The technical implementation of this vulnerability stems from insufficient validation of request origins and the absence of anti-CSRF tokens in the chat-link handoff endpoint. When a user initiates a chat link process, the system generates a confirmation token that should be validated before binding external chat identities to user accounts. However, the vulnerable implementation fails to verify that requests originate from legitimate sources within the application context, making it possible for attackers to craft malicious web pages that automatically submit POST requests with valid tokens.
The operational impact of this vulnerability extends beyond simple identity theft, as it enables full impersonation capabilities within agent operations and allows attackers to inherit all permissions associated with the victim's account. This creates a significant risk for organizations relying on Budibase for business-critical applications, particularly those involving customer service automation or collaborative platforms where chat functionality is integral. The vulnerability essentially transforms any user who visits a malicious page into a potential attacker capable of performing actions that would normally require legitimate authentication.
Security practitioners should recognize this as a variant of CWE-352, which specifically addresses Cross-Site Request Forgery vulnerabilities in web applications. The attack vector aligns with techniques described in the MITRE ATT&CK framework under T1566, specifically targeting credential access through phishing and social engineering methods. Organizations utilizing Budibase should immediately upgrade to version 3.40.0 or later to address this vulnerability, while also implementing additional security controls such as Content Security Policy headers and implementing proper CSRF token validation mechanisms. The remediation process requires careful attention to ensure that all endpoints handling user identity binding operations properly validate request authenticity and implement robust anti-CSRF protections to prevent similar vulnerabilities from emerging in other parts of the application architecture.