CVE-2026-72849 is a CSRF vulnerability in Budibase server before version 3.40.0 affecting the chat-link handoff endpoint. Attackers can craft phishing pages that auto-submit POST requests containing leaked confirmation tokens to bind their chat identity to a victim user's account. This binding allows attackers to impersonate the victim in agent operations and inherit their permissions. The vulnerability has a CVSS 4.0 score of 8.7, indicating high impact with network attack vector, high complexity, and partial user interaction required. No vendor advisory or patch information is currently available.

Exploitation allows attackers to impersonate legitimate users within Budibase agent operations by binding their chat identity to the victim's account. This results in unauthorized access and permission inheritance, potentially leading to privilege escalation and unauthorized actions within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious of phishing attempts that could exploit this vulnerability. No official mitigation or workaround has been provided by the vendor at this time.