Description (CNA)
Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data including user IDs and external chat service identifiers from other workspaces they have no permission to access.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| budibase / server | affected 0 before 3.45.0; unaffected 3.45.0 |
CWE
CWE-863
References
- https://github.com/Budibase/budibase/security/advisories/GHSA-76m3-47v8-p7h6
- https://www.vulncheck.com/advisories/budibase-before-3.45.0-information-disclosure-via-chat-links
ADP enrichment
No English description supplied.