Summary
Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)
The Budibase AI chat-link handoff flow (GET/POST /api/chat-links/:instance/:token/handoff) binds an external chat identity (Slack/Discord/MS Teams/Telegram) to a Budibase user account. The confirmation endpoint is on a public route (no CSRF middleware, no auth-group gate) and the only credential it checks is a confirmationToken that is already rendered in plaintext into the HTML confirmation page the victim views. There is no binding between the confirmation token and the requester's Budibase session at preparation time, and no CSRF token on the POST.
Consequently, an attacker who creates a chat-link session for their own external chat identity (or any identity they can mint in their chat platform) can induce a victim Budibase user (same tenant) to submit the confirmation POST -> for example by sending them a link that auto-submits, or by XSS/CSRF on a co-tenanted page -> and the victim's globalUserId becomes bound to the attacker's external identity. The attacker then sends messages to the AI agent from their chat platform and is acting as the victim user inside Budibase automations/agent operations, inheriting the victim's permissions on agent operations, knowledge sources, and any downstream automation steps keyed off the linked identity.
Affected
| Component | Path | Lines |
|---|---|---|
| Public handoff routes (no auth-group middleware) | packages/server/src/api/routes/chat.ts |
23 (GET /api/chat-links/:instance/:token/handoff), 27 (POST .../handoff) |
| Confirmation controller | packages/server/src/api/controllers/ai/chatIdentityLinks.ts |
124-177 (confirmChatLinkSession); the binding at 153-173 |
| Confirmation token rendered into HTML | packages/server/src/api/controllers/ai/chatIdentityLinks.ts |
40-60 (renderLinkConfirmationPage); the hidden input at 55 |
| Session creation (attacker side) | packages/server/src/sdk/workspace/ai/chatIdentityLinks.ts |
138-171 (createChatIdentityLinkSession), 173-188 (prepareChatIdentityLinkSessionConfirmation) |
| Upsert of identity link | packages/server/src/sdk/workspace/ai/chatIdentityLinks.ts |
201-250 (upsertChatIdentityLink) |
Affected versions: master at commit 3c8d1b4023.
Reachable over HTTP by: the GET and POST are on publicRoutes (no auth-group middleware). The POST requires ctx.isAuthenticated at runtime (controllers/ai/chatIdentityLinks.ts:142) -> so the victim must be logged into Budibase when the POST fires (achievable via standard CSRF if cookies are sent cross-origin, or via phishing that lures the victim to submit).
Root cause
Issue 1 -> The handoff routes are public and unauthenticated at the middleware layer.
// packages/server/src/api/routes/chat.ts:23, 27
publicRoutes.get("/api/chat-links/:instance/:token/handoff", ai.handoffChatLinkSession)
publicRoutes.post("/api/chat-links/:instance/:token/handoff", ai.confirmChatLinkSession)
publicRoutes has no group middleware (endpointGroups/standard.ts:24-25 calls endpointGroupList.group() with no middleware and then .lockMiddleware()). The routes do not have a per-route authorized(...). There is no CSRF middleware on these routes -> Budibase's CSRF synchroniser token is enforced only for state-changing verbs on authenticated routes that are not in NO_CSRF_ENDPOINTS; the public-routes path bypasses it.
Issue 2 -> The confirmation token is exposed to anyone who views the GET page.
// packages/server/src/api/controllers/ai/chatIdentityLinks.ts:40-60
const renderLinkConfirmationPage = (session, action) => {
...
return `<!doctype html>...
<form method="post" action="${helpers.escapeHtml(action)}">
<input type="hidden" name="confirmationToken" value="${helpers.escapeHtml(session.confirmationToken)}">
<button type="submit">Confirm</button>
</form>
...`
}
The confirmationToken (a newid() UUIDv4 generated by prepareChatIdentityLinkSessionConfirmation) is rendered into a hidden form input. Anyone who loads the GET page sees the token in the page source.
Issue 3 -> The POST binds the currently-authenticated user to the external identity based solely on the confirmation token.
// packages/server/src/api/controllers/ai/chatIdentityLinks.ts:124-177
export async function confirmChatLinkSession(ctx) {
...
if (!ctx.isAuthenticated) { throw new HTTPError("Authentication is required to link chat identity", 401) }
if (!session.confirmationToken || ctx.request.body?.confirmationToken !== session.confirmationToken) {
throw new HTTPError("Link confirmation is invalid or has expired", 400)
}
const currentGlobalUserId = getCurrentGlobalUserId(ctx) // <- victim's ID
const consumedSession = await sdk.ai.chatIdentityLinks.consumeChatIdentityLinkSession(token)
...
await sdk.ai.chatIdentityLinks.upsertChatIdentityLink({
provider: consumedSession.provider,
externalUserId: consumedSession.externalUserId, // <- attacker's chat identity
externalUserName: consumedSession.externalUserName,
...
globalUserId: currentGlobalUserId, // <- bound to victim
linkedBy: currentGlobalUserId,
})
...
}
There is no binding between the session and the requester's Budibase identity at preparation time. prepareChatIdentityLinkSessionConfirmation (sdk/workspace/ai/chatIdentityLinks.ts:173-188) stores the confirmationToken keyed by token with no user-id field. Whoever is authenticated when the POST fires (and supplies the correct confirmationToken) gets bound.
Issue 4 -> assertSessionMatchesInstance only checks workspace ID, not user.
// packages/server/src/api/controllers/ai/chatIdentityLinks.ts:17-27
const assertSessionMatchesInstance = ({ workspaceId, instance }) => {
if (!workspaceId || workspaceId !== instance) {
throw new HTTPError("Link token is not valid for this workspace", 400)
}
}
The check confirms the session belongs to the same workspace as the URL instance param -> useful for preventing cross-workspace confusion but useless against same-tenant identity confusion.
Reproduction
Step-by-step attack
Attacker (tenant T) provisions a chat-link session for their own external identity. Via the agent channel provisioning flow (e.g.
POST /api/agent/:agentId/slack/provisionor via the Discord/MS Teams/Telegram provisioning endpoints), the attacker obtains a chat-linktokenbound to their own Slack user ID. The session is stored in Redis keyed bytoken, scoped to tenant T.Attacker triggers
prepareChatIdentityLinkSessionConfirmation. Either by GETting the handoff page themselves (if they have a Budibase session) or via an internal API. TheconfirmationTokenis generated and stored.Attacker crafts a phishing/auto-submit page that POSTs to
/api/chat-links/<instance>/<token>/handoffwith the leakedconfirmationTokenin the body. Example:<form id="f" method="post" action="https://victim.budibase.app/api/chat-links/app_xxx/linktoken/handoff"> <input name="confirmationToken" value="<leaked-token>"> </form> <script>document.getElementById('f').submit()</script>Victim (a Budibase user in tenant T, e.g. an admin) is lured to the attacker page while logged into Budibase. Their browser sends the POST cross-origin. If the Budibase auth cookie is sent on cross-site requests (
SameSite=Laxby default allows top-level POST navigations, which a form-submit is), the request is authenticated as the victim.The victim's
globalUserIdis now bound to the attacker's Slack identity. When the attacker DMs the AI agent from Slack, the agent's operations run as the victim user -> with the victim's permissions on agent operations, knowledge sources, file uploads, and any downstream automation steps keyed off the linked identity.
Mitigating factors:
SameSite=Laxcookies block cross-site POSTs from sub-resources (fetch / XHR) but allow top-level form-POST navigations. A phishing page that submits the form viadocument.form.submit()(a top-level navigation) succeeds. So the CSRF works with the default cookie policy.- The attack is same-tenant only (
session.tenantId !== context.getTenantId()is checked in the sdk). - The attacker must induce the victim to click a link (standard phishing). No silent drive-by.
Impact
| Capability | Available |
|---|---|
| Bind an attacker-controlled chat identity to a victim's Budibase account | ✅ |
| Send messages to the AI agent as the victim user (Slack/Discord/MS Teams/Telegram) | ✅ |
| Inherit the victim's permissions on agent operations | ✅ |
| Trigger automations / agent operations that the victim is authorised for | ✅ |
| Read knowledge sources the victim has access to | ✅ |
The severity depends on what the agent can do as the victim. For an admin victim, this is full tenant administration via chat. For a regular user, it is impersonation within the agent subsystem. The bound identity persists until manually unlinked, so the attacker retains ongoing access.
This is a same-tenant, user-interaction-required primitive. It is below the "unauthenticated RCE" threshold but above "hardening" -> it is a real authentication-confusion vulnerability on a sensitive identity-binding operation.
A victim's authenticated browser session is used to submit forged requests to an application that cannot distinguish them from legitimate ones. Typical impact: state-changing actions performed as the victim without their consent.
GHSA-PVCR-8MVP-W8QR has a CVSS score of 7.7 (High). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. No fixed version is listed yet, so configuration controls and monitoring matter more in the interim.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Recommended layered fixes:
Bind the confirmation token to the requester's Budibase session at preparation time. In
prepareChatIdentityLinkSessionConfirmation, store theglobalUserIdof the requester alongside theconfirmationToken. InconfirmChatLinkSession, verify thatgetCurrentGlobalUserId(ctx)matches the stored requester. This breaks the CSRF / cross-user confusion.Add a CSRF token to the confirmation POST. The standard Budibase CSRF synchroniser token (
x-csrf-tokenheader, validated against the session'scsrfToken) should be enforced onPOST /api/chat-links/.../handoff. Move the route out ofpublicRoutesto an authenticated route group so CSRF applies (the GET can remain public for the redirect-to-login flow; the POST should be authenticated + CSRF-protected).Add a per-session nonce that is bound to the requester's browser (e.g. a signed cookie set on the GET, validated on the POST) to prevent cross-origin submission even when
SameSite=Laxallows it.Require user re-authentication (re-entry of password / step-up auth) for sensitive identity-binding operations, similar to how password change requires re-auth.
Frequently Asked Questions
- What is GHSA-PVCR-8MVP-W8QR? GHSA-PVCR-8MVP-W8QR is a high-severity cross-site request forgery (CSRF) vulnerability in @budibase/server (npm), affecting versions <= 3.38.1. No fixed version is listed yet. A victim's authenticated browser session is used to submit forged requests to an application that cannot distinguish them from legitimate ones.
- How severe is GHSA-PVCR-8MVP-W8QR? GHSA-PVCR-8MVP-W8QR has a CVSS score of 7.7 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of @budibase/server are affected by GHSA-PVCR-8MVP-W8QR? @budibase/server (npm) versions <= 3.38.1 is affected.
- Is there a fix for GHSA-PVCR-8MVP-W8QR? No fixed version is listed for GHSA-PVCR-8MVP-W8QR yet. Monitor the advisory for updates and apply mitigations in the interim.
- Is GHSA-PVCR-8MVP-W8QR exploitable, and should I be worried? Whether GHSA-PVCR-8MVP-W8QR is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-PVCR-8MVP-W8QR is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-PVCR-8MVP-W8QR? No fixed version is listed yet. In the interim: Use per-session CSRF tokens on all state-changing operations and verify them server-side. SameSite cookie attributes provide additional defense.