CVE-2026-72849: Budibase chat-link handoff identity confusion and account-link CSRF

CVE-2026-72849 · Severity: high · CVSS 7.7 · Published 2026-08-13

Budibase's AI chat integration feature allows users to link external chat identities (Slack, Discord, Teams, Telegram) to their Budibase accounts for automated workflows. A flaw in the account-linking confirmation flow allows an attacker to trick a victim user into binding the victim's account to the attacker's external chat identity, enabling the attacker to impersonate the victim and execute automations with the victim's permissions and access to knowledge bases and downstream systems.

Technologies: @budibase/server (npm). Vendors: npm.

Quick answers

Is CVE-2026-72849 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-72849 being exploited in the wild.
How severe is CVE-2026-72849?
High severity, with a CVSS score of 7.7, published 13 August 2026.
Which products and versions are affected?
@budibase/server (npm) SEMVER:introduced=0,last_affected=3.38.1.
Is there a fix for CVE-2026-72849?
A patch was published on 2026-07-22: version 3.40.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72849 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-72849?
Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a combination of CSRF and inadequate session binding in the chat-link handoff flow (GET/POST /api/chat-links/:instance/:token/handoff). The confirmation endpoint is publicly accessible without authentication middleware or CSRF protection, and the only credential checked is a confirmationToken rendered in plaintext in the HTML confirmation page. The token is not bound to the requester's Budibase session at preparation time. An attacker can create a chat-link session for their own external chat identity, craft a confirmation link, and use CSRF or XSS on a co-tenanted page to trick an authenticated victim into submitting the POST request. The victim's globalUserId then becomes bound to the attacker's external chat identity. The attacker can subsequently send messages to the AI agent from their chat platform while impersonating the victim, inheriting all of the victim's permissions on agent operations and knowledge sources. The vulnerability requires the victim to be authenticated to Budibase at the time of exploitation. Patched in version 3.40.0.

Affected products

  • Budibase @budibase/server <3.40.0

Identifiers

  • CVE-2026-72849
  • GHSA-pvcr-8mvp-w8qr

Timeline

  • 2026-07-24: disclosed
  • 2026-07-22: patched: version 3.40.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.