A public endpoint in Budibase allows an attacker to permanently link an external chat identity, such as Slack, Discord or Microsoft Teams, to an authenticated Budibase user account without requiring user consent or CSRF protection. The operation requires no authentication on the server side, and the response confirms success without indicating that the link was created. This behavior gives the attacker the ability to impersonate the victim and use the linked chat identity to perform actions on the victim’s behalf.

Budibase, an open‑source low‑code platform, is affected on all releases prior to 3.39.0. The vulnerability exists in the GET /api/chat-links/:instance/:token/handoff endpoint, which is available to unauthenticated users. Upgrading to version 3.39.0 or later resolves the issue.

The vulnerability carries a CVSS score of 7.3, indicating high severity. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog. Attackers can exploit it by crafting a URL containing a session token that includes an attacker‑controlled externalUserId. If an authenticated user visits the URL, the attacker successfully links the user’s account to their chat identity, enabling account impersonation and potential further abuse. The lack of authentication, consent, and CSRF protection makes the attack vector straightforward and the exploitation probability high for any user who clicks a malicious link.