Executive brief
Budibase is a low-code platform for building web applications. The platform's chat integration feature failed to properly restrict access to chat identity link data by workspace, allowing a builder with access to a single workspace to retrieve sensitive linking information—including user IDs and external service identifiers—from other workspaces in the same tenant that they should not have access to.
Technical details
The GET /api/chat-links endpoint is protected only by a builder-level auth check that validates the user is a builder in some workspace, but the handler returns all chat identity links for the entire tenant without filtering by the requesting user's workspace. The vulnerability exists in the listChatIdentityLinks SDK function, which queries by tenantId only and lacks a workspace boundary check. When both provider and agentId parameters are supplied, the endpoint correctly scopes results; the missing filter on the "no agentId given" branch is an authorization bypass (CWE-863).
Affected products
- Budibase Budibase before 3.45.0
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: version 3.45.0