CVE-2026-50132 Details
Description
Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token/handoff` is a public endpoint (no auth required) that performs a permanent, state-changing operation: it binds an external chat identity (Slack/Discord/MS Teams) to an authenticated Budibase user account, with no consent UI and no CSRF protection. The session token in the URL is created by the attacker (from their own /link slash command) and embeds the attacker's externalUserId. When an authenticated Budibase victim visits the URL, their account is silently and permanently linked to the attacker's Slack/Discord identity. The server responds with "Authentication succeeded." — no indication of what was linked. This vulnerability is fixed in 3.39.0.
A vulnerability in Budibase versions prior to 3.39.0 allows for unauthorized linking of external chat identities (Slack, Discord, MS Teams) to Budibase user accounts. The issue arises from a public endpoint that performs a permanent, state-changing operation without requiring authentication. The endpoint lacks a consent user interface and cross-site request forgery (CSRF) protection. Exploitation involves an attacker generating a session token through their own Slack link command, which is then used to silently bind their chat identity to that of an authenticated Budibase user. The vulnerability was introduced in Budibase version 3.37.2.
Users can update to Budibase version 3.39.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Budibase/budibase/security/advisories/GHSA-v7j5-vc4m-723w | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/Budibase/budibase/security/advisories/GHSA-v7j5-vc4m-723w | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| budibase budibase | < 3.39.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 30, 2026 | Initial Analysis | [email protected] |
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |