CVE-2026-72849: Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF
Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user's account, enabling impersonation within agent operations and inheritance of victim permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Budibaseto a version that resolves this vulnerability.Fixed in 3.40.0Patch Identity Confusion via Chat-Link Handoff CSRF - Compensating control
Mitigate the CSRF risk in the chat-link handoff endpoint by preventing cross-site requests to the vulnerable endpoint (e.g., restrict/limit access paths and enforce CSRF protections at the application boundary) until the Budibase upgrade to 3.40.0 is applied.
Event History
Frequently Asked Questions
What is CVE-2026-72849?
CVE-2026-72849 is a cross-site request forgery vulnerability in Budibase before version 3.40.0 that allows attackers to bind an external chat identity to a victim's account.
What is the severity of CVE-2026-72849?
The severity of CVE-2026-72849 is rated as high with a score of 7.7.
How do I fix CVE-2026-72849?
To fix CVE-2026-72849, upgrade to Budibase version 3.40.0 or later.
What type of attack does CVE-2026-72849 involve?
CVE-2026-72849 involves a cross-site request forgery (CSRF) attack.
What impact can CVE-2026-72849 have on users?
CVE-2026-72849 can allow attackers to bind unauthorized external chat identities to a victim's account, compromising user accounts.