Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100685Budibase before 3.45.0 Information Disclosure via Chat Links

High 7.7

In plain English

A high-severity incorrect authorization in server from budibase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.3%top 81.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data including user IDs and external chat service identifiers from other workspaces they have no permission to access.

Affected products (as reported)

Vendor	Product	Versions
budibase	server	0 – before 3.45.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-76m3-47v8-p7h6) vendor-advisory
VulnCheck Advisory: Budibase before 3.45.0 Information Disclosure via Chat Links third-party-advisory