CVE-2026-100685
Received Received - Intake

Budibase Chat Link Enumeration Vulnerability

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data including user IDs and external chat service identifiers from other workspaces they have no permission to access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100685
EUVD
EUVD-2026-87658

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
budibase budibase to 3.45.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Budibase before version 3.45.0 has a flaw where the GET /api/chat-links endpoint does not restrict data access by workspace. This allows builders with access to one workspace to view sensitive chat identity link records from all workspaces in the same tenant, including user IDs and external chat service identifiers.

Impact Analysis

If you are a Budibase user with builder access to any workspace, an attacker could exploit this to steal sensitive data such as user IDs and chat service identifiers from other workspaces you do not have permission to access.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating privacy requirements under GDPR and HIPAA by allowing access to sensitive user information without proper authorization.

Mitigation Strategies

Upgrade Budibase to version 3.45.0 or later to address the improper scoping of the GET /api/chat-links endpoint. Ensure only authorized users have builder access to workspaces.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100685. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart