CVE-2026-100685 in Budibase
Riassunto
di MITRE • 26/09/2026
Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data including user IDs and external chat service identifiers from other workspaces they have no permission to access.
If you want to get best quality of vulnerability data, you may have to visit VulDB.