Executive brief
Budibase's AI chat integration feature allows users to link external chat identities (Slack, Discord, Teams, Telegram) to their Budibase accounts for automated workflows. A flaw in the account-linking confirmation flow allows an attacker to trick a victim user into binding the victim's account to the attacker's external chat identity, enabling the attacker to impersonate the victim and execute automations with the victim's permissions and access to knowledge bases and downstream systems.
Technical details
The vulnerability is a combination of CSRF and inadequate session binding in the chat-link handoff flow (GET/POST /api/chat-links/:instance/:token/handoff). The confirmation endpoint is publicly accessible without authentication middleware or CSRF protection, and the only credential checked is a confirmationToken rendered in plaintext in the HTML confirmation page. The token is not bound to the requester's Budibase session at preparation time. An attacker can create a chat-link session for their own external chat identity, craft a confirmation link, and use CSRF or XSS on a co-tenanted page to trick an authenticated victim into submitting the POST request. The victim's globalUserId then becomes bound to the attacker's external chat identity. The attacker can subsequently send messages to the AI agent from their chat platform while impersonating the victim, inheriting all of the victim's permissions on agent operations and knowledge sources. The vulnerability requires the victim to be authenticated to Budibase at the time of exploitation. Patched in version 3.40.0.
Affected products
- Budibase @budibase/server <3.40.0
Timeline
- 2026-07-24: disclosed
- 2026-07-22: patched: version 3.40.0