CVE-2026-100685 in Budibase
Summary
by MITRE • 09/26/2026
Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data including user IDs and external chat service identifiers from other workspaces they have no permission to access.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in Budibase versions prior to 3.45.0 represents a critical failure in server-side request forgery controls, specifically manifesting as an insecure direct object reference within the application's API layer. The core technical flaw resides in the implementation of the GET /api/chat-links endpoint, which is designed to retrieve chat identity link records associated with specific workspaces. However, the backend logic fails to enforce strict scoping based on the authenticated user’s workspace permissions or tenant boundaries. Instead of validating that the requesting builder has explicit access rights to the target workspace before returning data, the API accepts identifiers and returns corresponding records regardless of ownership. This architectural oversight effectively bypasses the intended isolation mechanisms between workspaces within a multi-tenant environment, allowing for unauthorized cross-workspace data retrieval.
From an operational perspective, this flaw enables attackers who possess builder-level access in any single workspace to enumerate sensitive chat identity linking information across all other workspaces hosted by the same tenant. By iterating through potential identifiers or exploiting predictable patterns in the API responses, a malicious actor can extract user IDs and external chat service identifiers belonging to users in unrelated workspaces. This capability transforms a limited privilege escalation into a broad data exfiltration vector. The exposed data includes personally identifiable information such as unique user identifiers and links to external communication platforms, which compromises the privacy of end-users and violates the principle of least privilege that underpins secure multi-tenant architectures.
The security implications are significant, particularly regarding compliance with industry standards for access control and data protection. This vulnerability aligns closely with CWE-639, Authorization Bypass Through User-Controlled Key, as the application relies on a key (the workspace or record identifier) without sufficiently verifying that the actor is authorized to perform the action associated with it. Furthermore, from an offensive security taxonomy perspective, this behavior corresponds to ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials but exploit misconfigurations in access control logic rather than stealing passwords directly. The exposure of external chat service identifiers also poses a risk for subsequent social engineering attacks or targeted phishing campaigns against users whose contact information has been harvested through this enumeration process.
To mitigate this vulnerability, organizations must immediately upgrade to Budibase version 3.45.0 or later, where the developers have implemented proper scoping logic that restricts data retrieval to only those workspaces explicitly assigned to the authenticated user’s role. For environments unable to patch immediately due to operational constraints, temporary mitigations should focus on network-level controls and API gateway configurations. Implementing strict input validation at the reverse proxy level can help detect anomalous enumeration patterns by monitoring for rapid sequential requests targeting different workspace identifiers. Additionally, auditing existing builder accounts is essential to identify any compromised credentials that may have been used to exploit this flaw prior to remediation. Regular security assessments of multi-tenant applications should include rigorous testing of cross-workspace isolation to ensure that role-based access controls are correctly enforced at the API layer and not just in the user interface.