{"data":{"id":"0dd8e152-af4e-46b4-b357-811bba0a09db","title":"GHSA-v7j5-vc4m-723w: Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF","summary":"Budibase 3.37.2 exposes a public endpoint, GET /api/chat-links/:instance/:token/handoff, handled by handoffChatLinkSession in packages/server/src/api/controllers/ai/chatIdentityLinks.ts, with no authentication middleware and no CSRF protection. A link token created by an attacker from their own /link slash command embeds the attacker's externalUserId, and when an authenticated Budibase user visits the URL, the server permanently binds the attacker's Slack, Discord or MS Teams identity to that user's account without any consent prompt, returning only \"Authentication succeeded.\" The issue is rated High, CVSS 3.1 7.3 (CWE-352, CWE-284), and the flaw is reported as introduced in this version.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-v7j5-vc4m-723w","publishedAt":"2026-06-22T23:08:23.000Z","cveId":"CVE-2026-50132","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@budibase/server@< 3.39.0 (fixed: 3.39.0)"],"affectedPackageNames":["@budibase/server"],"affectedPackageRefs":["npm:@budibase/server"],"affectedVendors":[],"affectedVendorsRaw":["Budibase"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00192,"epssCheckedAt":"2026-10-14T18:05:59.956Z","kevDateAdded":null,"advisoryAliases":["GHSA-v7j5-vc4m-723w"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-22T23:08:23.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.7,"researchCategory":null,"atlasIds":null}}