The vulnerability in Budibase's chat-link handoff flow arises because the confirmation endpoint (GET/POST /api/chat-links/:instance/:token/handoff) is a public route lacking CSRF middleware and authorization middleware. The confirmation token used to bind an external chat identity to a Budibase user is rendered in plaintext in the HTML confirmation page, making it accessible to anyone viewing the page. The POST request that confirms the link only verifies the confirmation token and requires the victim to be authenticated but does not bind the token to the victim's session. Consequently, an attacker can create a chat-link session for their own external chat identity and induce a logged-in victim user to submit the confirmation POST (via CSRF or phishing). This causes the victim's Budibase user ID to be linked to the attacker's external identity, allowing the attacker to impersonate the victim within Budibase's AI agent and automation context, inheriting their permissions and access.

An attacker can cause a victim user within the same Budibase tenant to link their Budibase account to an attacker-controlled external chat identity. This leads to identity confusion, allowing the attacker to send messages to the AI agent and perform agent operations with the victim's permissions. The attacker effectively impersonates the victim user within Budibase automations and knowledge sources, potentially leading to unauthorized actions and data access. The vulnerability requires the victim to be authenticated in Budibase and can be exploited via CSRF or phishing techniques.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious of unsolicited links that might trigger the chat-link handoff confirmation. Implementing CSRF protection on the confirmation POST endpoint and ensuring the confirmation token is not exposed in plaintext in the HTML page are recommended mitigations. Additionally, binding the confirmation token to the authenticated user's session would prevent cross-user confirmation attacks. Monitoring for updates from Budibase regarding official fixes is advised.