What’s Vulnerable › Vulnerabilities

CVE-2026-100685: Budibase before 3.45.0 Information Disclosure via Chat Links

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-26 · updated 2026-10-08
• Weakness: CWE-863

Description

Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data including user IDs and external chat service identifiers from other workspaces they have no permission to access.

Affected products

• budibase server: before 3.45.0 — fixed in 3.45.0

How to fix

Upgrade to a fixed version: budibase server 3.45.0. Check the vendor advisory for mitigations.

References

• https://github.com/Budibase/budibase/security/advisories/GHSA-76m3-47v8-p7h6
• https://www.vulncheck.com/advisories/budibase-before-3.45.0-information-disclosure-via-chat-links
• https://github.com/Budibase/budibase/security/advisories/GHSA-76m3-47v8-p7h6

Get alerted when CVE-2026-100685 or the next vulnerability affects your stack