CVE-2026-50132 Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase
Attackers can hijack chat identity links via CSRF, silently binding victim accounts to attacker-controlled external identities without consent.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-50132?
CVE-2026-50132 is a high-severity vulnerability in budibase, published on 26 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token/handoff` is a public endpoint (no auth required) that performs a permanent, state-changing operation: it binds an external chat identity (Slack/Discord/MS Teams) to an authenticated Budibase user account, with no consent UI and no CSRF protection. The session token in the URL is created by the attacker (from their own /link slash command) and embeds the attacker's externalUserId. When an authenticated Budibase victim visits the URL, their account is silently and permanently linked to the attacker's Slack/Discord identity. The server responds with "Authentication succeeded." — no indication of what was linked. This vulnerability is fixed in 3.39.0.
Which versions are affected by CVE-2026-50132?
2 open source packages ship an affected version, including @budibase/server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@budibase/server npm | All versions | 3.39.0 |
@budibase/server npm | All versions | 3.39.0 |
Products include Budibase Budibase.
How do I fix CVE-2026-50132?
Upgrade @budibase/server to 3.39.0 or later.
Is CVE-2026-50132 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50132 exists.
Other vulnerabilities in budibase
- CVE-2026-54350 Budibase: Anonymous NoSQL operator injection via published-app query templates
- CVE-2026-27702 Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)
- CVE-2026-54352 Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload
- CVE-2026-31818 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
- CVE-2026-30240 Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets
Sources
Also known as GHSA-v7j5-vc4m-723w.