HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-72849 — Budibase before 3.40.0 contains a cross-site request forgery vulnerability in th...

·Source: NIST NVD

Updated:

Executive Summary

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user's account, enabling impersonation within agent operations and inh

Analysis

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user's account, enabling impersonation within agent operations and inheritance of victim permissions. CVSS Score: 7.7. Published: 2026-08-13T22:17:24.140.

Indicators of Compromise (1)

CVE (1)
CVE-2026-72849
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 13, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Financial data startup Quatr raises $18 million

Quartr, the world's leading first-party data layer for institutional finance and AI, today announced it has closed a $18 million funding round, led by existing investor Altos Ventures with participation from new investor SEB (publ.)

Finextra
LOWVulnerabilityNEW

300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw

Tracked as CVE-2026-15748, the arbitrary file upload bug allows unauthenticated attackers to upload executable files. The post 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw appeared first on SecurityWeek .

CVE-2026-15748
SecurityWeek
LOWVulnerability

Confluence adds AI-enabled automation to its product suite.

Confluence Technologies, Inc. (“Confluence”), a global leader in regulatory, analytics, and investor communications solutions for the investment management industry, today announced the launch of Confluence POINT, AI-enabled automation that optimizes workflows across its solutions.

Finextra