Budibase CVE-2026-72849

The following specific conditions must all be satisfied simultaneously: (1) The AI chat-link handoff feature must be enabled in the Budibase deployment and the affected endpoint /api/chat-links/:instance/:token/handoff must be reachable by the attacker. (2) The attacker must have sufficient access to the Budibase tenant to initiate a chat-link session for an external chat identity they control - the CVSS PR:L rating indicates low-privilege (authenticated) attacker access is required, not unauthenticated. (3) The victim must be an authenticated Budibase user on the same tenant (ctx.isAuthenticated check at confirmChatLinkSession line 142 requires the victim's session cookie to be valid). (4) The victim must be socially engineered into loading the attacker's phishing page while their Budibase session is active (UI:P). (5) AT:P reflects that specific environmental conditions must exist: the attacker and victim must share a tenant, and the attacker must have already generated a valid confirmationToken for an identity they control. Exploitation is limited by: the requirement for same-tenant attacker presence (cross-tenant attacks are not possible), the need for an active victim session, and the social engineering step for user interaction. The endpoint is on public routes (no auth-group middleware), but the victim-side action requires an authenticated browser session.

The CVSS 4.0 score of 8.7 (AV:N/AC:H/AT:P/PR:L/UI:P) is appropriate and consistent with the described attack surface. Attack complexity is correctly assessed as High: the attacker must obtain a valid confirmationToken for an identity they control, craft a phishing page that auto-submits the forged POST, and socially engineer a same-tenant victim who is simultaneously authenticated in Budibase. AT:P correctly reflects the prerequisite that the target must be on the same tenant and have the chat-link AI feature accessible. PR:L is justified because the attacker must be able to initiate a chat-link session, implying some level of platform access. The subsequent-system high impact (SC:H/SI:H) captures the real danger: post-exploitation, the attacker does not merely read data but actively operates as the victim inside AI automations, potentially triggering business logic, accessing knowledge bases, or exfiltrating data through agent actions. EPSS data is not provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV and no public POC code is confirmed, reducing immediate automated exploitation risk. However, the GHSA advisory discloses precise file paths, line numbers, and the full attack mechanism, lowering the technical bar for exploitation significantly. Risk is highest for multi-tenant Budibase deployments where the AI chat-link feature is enabled and multiple users share a workspace, particularly where privileged victim accounts exist.

An attacker with low-level access to a shared Budibase tenant initiates a chat-link session for their own Slack identity, which generates a confirmationToken visible in the HTML of the confirmation page they receive. The attacker then constructs a phishing page containing a hidden form that auto-submits a POST to /api/chat-links/:instance/:token/handoff with the attacker's confirmationToken embedded, and sends the phishing link to a victim Budibase user who is currently logged in. When the victim's authenticated browser loads the page, the form fires automatically, their globalUserId is silently rebound to the attacker's Slack identity, and the attacker can subsequently send Slack messages to Budibase's AI agent and execute operations with the victim's workspace permissions. No public exploit code is confirmed, but the GHSA advisory provides sufficient technical detail to construct one.