HIGH 8.3 NVD
CVE-2026-100685
Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across a
Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data including user IDs and external chat service identifiers from other workspaces they have no permission to access.
References
- https://github.com/Budibase/budibase/security/advisories/GHSA-76m3-47v8-p7h6
- https://www.vulncheck.com/advisories/budibase-before-3.45.0-information-disclosure-via-cha
This high severity vulnerability with a CVSS score of 8.3 was published on 2026-09-26 via NVD.
vulnfeed aggregates 11675 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.