CVE Feed

    Dashboard / CVE / CVE-2026-100685

    CVE-2026-100685

    Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data including user IDs and external chat service identifiers from other workspaces they have no permission to access.

    Published:Sep 26, 2026
    Last Modified:Sep 30, 2026
    EPS:Sep 26, 2026
    EPSS Score:0.00209
    CVSS Score:7.7

    Affected Products

    Vendor
    Budibase
    Product
    Server

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-863 Incorrect Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-100688 (CVSS 7.1) — Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/app…
    CVE-2026-100687 (CVSS 7) — Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external ta…
    CVE-2026-100686 (CVSS 8.6) — Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId…
    CVE-2026-100684 (CVSS 9.2) — Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibas…
    CVE-2026-100683 (CVSS 8.9) — Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/sr…
    CVE-2026-100682 (CVSS 8.7) — Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint t…
    CVE-2026-100681 (CVSS 6.3) — Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vul…
    CVE-2026-100680 (CVSS 8.6) — Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger impo…
    CVE-2026-82246 (CVSS 7.1) — Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoin…
    CVE-2026-82245 (CVSS 7.2) — Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High