Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token/handoff` is a public endpoint (no auth required) that performs a permanent, state-changing operation: it binds an external chat identity (Slack/Discord/MS Teams) to an authenticated Budibase user account, with no consent UI and no CSRF protection. The session token in the URL is created by the attacker (from their own /link slash command) and embeds the attacker's externalUserId. When an authenticated Budibase victim visits the URL, their account is silently and permanently linked to the attacker's Slack/Discord identity. The server responds with "Authentication succeeded." — no indication of what was linked. This vulnerability is fixed in 3.39.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-26 | 2 | Disclosure2 |
| 2026-06-27 | 1 | Disclosure1 |
CVE-2026-50132 Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token/handoff` is a public endpoint (no auth required) that performs a … https://www.cve.org/CVERecord?id=CVE-2026-50132
Post summary
The post announces CVE-2026-50132 in Budibase, detailing an unauthenticated public API endpoint vulnerability, with no PoC, exploit, patch, or active exploitation mentioned.
CVE-2026-50132 Unauthenticated Account Linking via CSRF in Budibase Prior to 3.39.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-50132
Post summary
A newly disclosed CVE (2026-50132) describes an unauthenticated CSRF‑based account linking flaw affecting Budibase versions older than 3.39.0.
🚨*CVE* CVE-2026-50132 Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token/handoff` is a public endpoint (no auth required) that performs a … https://www.cve.org/CVERecord?id=CVE-2026-50132 ----- Traducción: CVE-2026-50132 Bud… http://infoflow.cloud`
Post summary
The passage announces CVE-2026-50132 for Budibase, noting that before version 3.39.0 a public, unauthenticated endpoint exists, but it does not provide a PoC, exploit, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | budibase | budibase | - | - | - |