CVE-2026-100685: Budibase before 3.45.0 Information Disclosure via Chat Links
Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data including user IDs and external chat service identifiers from other workspaces they have no permission to access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs builder access to at least one workspace in a Budibase tenant. They can then query the chat-links endpoint to enumerate records belonging to other workspaces in that same tenant.
What information could be exposed?
The exposed chat identity link records can include user IDs and identifiers from external chat services. The issue is an information disclosure; the provided data does not indicate modification or deletion of records.
Are all Budibase deployments affected?
Budibase versions before 3.45.0 are affected where users have builder access and chat identity link records exist in the tenant. The vulnerability crosses workspace permission boundaries within a tenant.
What is the immediate mitigation if upgrading is not possible?
Restrict builder access to trusted users, because builder privileges in any workspace are sufficient to access chat-link records across the tenant. Review and remove unnecessary builder roles until an upgrade to 3.45.0 or later can be performed.