Sagarrchauhann

**Name of the Vulnerable Software and Affected Versions** Budibase versions prior to 3.45.0 **Description** An issue exists where the system fails to properly scope the 'GET /api/chat-links' endpoint by workspace. This allows users with builder access to a single workspace to enumerate chat identity link records across all workspaces within a tenant, potentially retrieving sensitive data such as `user IDs` and external chat service identifiers from workspaces they are not permitted to access. **Recommendations** Update to version 3.45.0 or later. As a temporary mitigation, restrict access to the 'GET /api/chat-links' endpoint.