CVE-2026-100685

HIGHCVSS 7.7

Description

Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data including user IDs and external chat service identifiers from other workspaces they have no permission to access.

Timeline

Published:September 26th, 2026 2:16 PM

Last modified:September 30th, 2026 6:18 PM

CVSS Scoring

CVSS v3: 7.7 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-863

References & Reports

Advisories, patches, and third-party reports

https://github.com/Budibase/budibase/security/advisories/GHSA-76m3-47v8-p7h6
https://www.vulncheck.com/advisories/budibase-before-3.45.0-information-disclosure-via-chat-links
https://github.com/Budibase/budibase/security/advisories/GHSA-76m3-47v8-p7h6

Source: NIST NVD · Data may lag official sources by up to one minute