Description
Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user's account, enabling impersonation within agent operations and inheritance of victim permissions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| budibase | server | < 3.40.0 | 3.40.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @budibase/server | <= 3.38.1 | — | GHSA-pvcr-8mvp-w8qr |
References
- GitHub Security Advisory (GHSA-pvcr-8mvp-w8qr) vendor-advisory
- VulnCheck Advisory: Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF third-party-advisory