What is CVE-2026-72849?
This is a Cross-Site Request Forgery (CSRF) vulnerability in the chat-link handoff endpoint of Budibase versions before 3.40.0. An attacker can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind an external chat identity to the victim's account. Users should immediately upgrade to version 3.40.0 or later.
Azərbaycanca: Bu boşluq Budibase platformasının 3.40.0 versiyasından əvvəlki versiyalarında chat-link handoff endpoint-də aşkar edilmiş Cross-Site Request Forgery (CSRF) zəifliyidir. Təcavüzkar sızdırılmış təsdiq tokeni ilə fişinq səhifəsi yaradaraq istifadəçinin hesabına icazəsiz xarici chat kimliyi bağlaya bilər. İstifadəçilər dərhal 3.40.0 və ya daha yuxarı versiyaya yeniləmə aparmalıdır.
Related CVEs
link basis: same weakness class CWE-352
FAQ1
What type of vulnerability is CVE-2026-72849 in Budibase?
It is a Cross-Site Request Forgery (CSRF) vulnerability found in the chat-link handoff endpoint of Budibase versions before 3.40.0.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.