CVE-2026-100685

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.45.0

Description An issue exists where the system fails to properly scope the 'GET /api/chat-links' endpoint by workspace. This allows users with builder access to a single workspace to enumerate chat identity link records across all workspaces within a tenant, potentially retrieving sensitive data such as user IDs and external chat service identifiers from workspaces they are not permitted to access.

Recommendations Update to version 3.45.0 or later. As a temporary mitigation, restrict access to the 'GET /api/chat-links' endpoint.