Information Disclosure in Budibase by Budibase

CVE-2026-100685

What is CVE-2026-100685?

Budibase prior to version 3.45.0 is susceptible to an information disclosure vulnerability due to improper scoping of the GET /api/chat-links endpoint. This flaw permits builders with access to one workspace to potentially list chat identity link records from all workspaces within a tenant. Consequently, attackers can exploit this endpoint to access sensitive user identification details, including user IDs and links to external chat services, from workspaces they do not have permission to infiltrate. For more information, refer to the GitHub Security Advisory and VulnCheck Advisory.

References