Weakness in Budibase Open-Source Low-Code Platform Allows Unauthorized Account Linking

CVE-2026-50132

What is CVE-2026-50132?

The Budibase platform, prior to version 3.39.0, contains a significant security vulnerability in its public API endpoint that allows an attacker to link their external chat identity (e.g., Slack, Discord, MS Teams) to a victim's user account without consent. This occurs via a malformed URL that an authenticated user inadvertently accesses, leading to unauthorized account modifications. The attack is facilitated by the absence of proper authentication and CSRF protection mechanisms, resulting in a silent and permanent link of the attacker's chat identity to the victim's account, associated with an 'Authentication succeeded' response. This flaw underscores the importance of implementing robust security measures for public endpoints.

References