Advisory · CVE-2026-100685
Budibase chat-links endpoint spills cross-workspace identity data
Budibase before 3.45.0 fails to scope the GET /api/chat-links endpoint by workspace. A builder with access to a single workspace can enumerate chat identity link records across all workspaces in the tenant, retrieving user IDs and external chat service identifiers from workspaces they have no permission to access. Fixed in 3.45.0.
- Vendor
- Budibase
- Product
- Budibase
- Identifier / CWE
- CVE-2026-100685
CWE-863 - Action timing
- Immediate
Explain it like I’m five
Each department has its own locked contacts drawer, but the drawer labels all open to the same master list. A manager with one department's key can flip through every department's contacts.
- 01Single-workspace builder
A builder holds access to just one workspace in the tenant.
- 02Unscoped endpoint
GET /api/chat-links is not scoped by workspace.
- 03Enumeration
The builder enumerates chat identity link records across all workspaces.
- 04Identity spill
User IDs and external chat service identifiers from unauthorized workspaces are retrieved.
What happened
Budibase before 3.45.0 fails to scope the GET /api/chat-links endpoint by workspace (CVE-2026-100685, CVSS 8.3). A builder with access to a single workspace can enumerate chat identity link records across all workspaces in the tenant, retrieving user IDs and external chat service identifiers from workspaces they have no permission to access. The issue is fixed in Budibase 3.45.0.
What to do
- Upgrade Budibase to 3.45.0 or later.
- Audit access logs for unusual enumeration of the chat-links endpoint.
- Review whether workspace isolation assumptions held elsewhere; missing scoping in one endpoint often means missing scoping in others.
Management note
Workspace isolation is a tenant boundary, and every unscoped endpoint is a hole in it. This one leaks identity mappings, which are exactly what an attacker needs to target users in workspaces they cannot otherwise see.