{"id":"EUVD-2026-58500","revision":"fda048901deb4bca82ad85c4993ce579","records":[{"revision":"fda048901deb4bca82ad85c4993ce579","observedAt":"2026-10-28T09:37:49.07+00:00","statement":{"source":"euvd","id":"EUVD-2026-58500","aliases":["CVE-2026-72849","GHSA-4q4m-8h83-fcmr"],"title":"Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submit…","description":"Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user's account, enabling impersonation within agent operations and inheritance of victim permissions.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","score":8.7,"severity":null}],"references":["https://github.com/Budibase/budibase/security/advisories/GHSA-pvcr-8mvp-w8qr","https://www.vulncheck.com/advisories/budibase-before-identity-confusion-via-chat-link-handoff-csrf"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-58500","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 13, 2026, 9:54:41 PM","dateUpdated":"Oct 8, 2026, 3:24:34 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-58500","identifiers":["EUVD-2026-58500","CVE-2026-72849","GHSA-4q4m-8h83-fcmr"]},"retained":false,"historicalAffected":[]}],"coverage":[]}