CVE-2026-72849: Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF
Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user's account, enabling impersonation within agent operations and inheritance of victim permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.40.0Patch Identity Confusion via Chat-Link Handoff CSRF - Compensating control
Mitigate the CSRF risk in the chat-link handoff endpoint by preventing cross-site requests to the vulnerable endpoint (e.g., restrict/limit access paths and enforce CSRF protections at the application boundary) until the Budibase upgrade to 3.40.0 is applied.