GHSA-v7j5-vc4m-723w: Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF

Budibase versions up to 3.37.2 have a high-severity account impersonation vulnerability in the chat identity linking feature. An attacker can trick an authenticated user into visiting a specially crafted URL that silently links the victim's Budibase account to the attacker's external chat identity (Slack, Discord, or MS Teams) without requiring the victim's consent or CSRF protection (a token that verifies the user actually intended to perform the action). This allows the attacker to impersonate the victim in chat integrations.