CVE-2026-100685

Executive Summary

CVE-2026-100685 is an improper authorization vulnerability in Budibase before 3.45.0 affecting the GET /api/chat-links endpoint, which fails to scope results by workspace. An authenticated user with builder privileges in a single workspace can enumerate chat identity link records belonging to all other workspaces within the same tenant, exposing user IDs and external chat service identifiers. With a CVSS base score of 7.7, the flaw enables cross-tenant boundary violations at the workspace level and constitutes a serious confidentiality breach for multi-workspace deployments.

Technical Analysis

The vulnerability is classified as CWE-863 (Incorrect Authorization). In Budibase's multi-workspace architecture, workspaces are intended to be isolated authorization domains: a builder's privileges are scoped to the workspace(s) they belong to. The GET /api/chat-links endpoint is responsible for returning records that link Budibase user identities to external chat service accounts. According to the NVD description, the endpoint fails to properly scope this query by workspace, meaning the authorization check validates only that the caller is a builder—not that the caller is entitled to view link records outside their own workspace.

The practical consequence is a horizontal (and effectively vertical in shared-tenant contexts) privilege boundary bypass: any builder can retrieve chat identity link records across every workspace in the tenant. The data exposed includes user IDs and external chat service identifiers. Because the request is a normal authenticated API call against an endpoint the builder is already permitted to reach, the flaw requires no memory corruption, injection, or special payload—it is a pure broken-access-control / IDOR-style authorization gap. The CVSS scope change (S:C) reflects that exploitation of a component scoped to one workspace impacts resources in other workspaces, driving the confidentiality impact to High (C:H) while integrity and availability remain unaffected.

No public proof-of-concept, exploit code, or Nuclei template is currently available, and the vulnerability is not listed in CISA KEV. As of this report, patch confidence is 0/4: no patch evidence has been identified from tracked sources, though the vendor-fixed boundary is stated as version 3.45.0.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-863, broken workspace scoping) and the endpoint named in the NVD description.

1. Reconnaissance / target identification. An attacker obtains or already holds a legitimate account with builder privileges in at least one workspace of a Budibase tenant. They identify a target instance running Budibase before 3.45.0 (e.g., via the login/portal fingerprint) and confirm their builder access.

2. Triggering the flaw. The attacker authenticates and issues a request to GET /api/chat-links using their builder session. Because the endpoint does not scope the query to the caller's workspace, the server returns chat identity link records for all workspaces in the tenant rather than only those the builder is authorized to view. No parameter manipulation, injection, or crafted payload is required—the default response is over-broad.

3. Payload/execution method (class level). This is a broken-access-control exploitation: the "payload" is simply an authenticated request to the vulnerable endpoint. There is no buffer, no injection sink, and no client-side bypass; success depends entirely on the server's failure to enforce workspace authorization on the returned dataset.

4. Post-exploitation impact. The attacker harvests user IDs and external chat service identifiers from workspaces they do not own or administer. This intelligence enables correlation of internal user identities with external chat accounts, supports social engineering and phishing targeting, and may facilitate lateral movement or impersonation via the linked chat services. It is a data-exfiltration outcome with no direct code execution or availability impact.

Impact Assessment

Business impact centers on confidentiality loss across workspace boundaries within a tenant. A single low-privilege builder account—normally the least-trusted privileged role—acts as a pivot to read identity-link data belonging to every workspace, undermining the isolation guarantees Budibase tenants rely on for departmental or customer separation. Exposed data (user IDs and external chat service identifiers) is directly usable for identity correlation, targeted phishing, and mapping of organizational chat integrations.

Per the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N (base 7.7): the attack is network-reachable (AV:N), requires no special conditions (AC:L), needs only low privileges (PR:L), requires no user interaction (UI:N), crosses a security scope boundary (S:C), and yields High confidentiality impact (C:H) with no integrity (I:N) or availability (A:N) impact. Blast radius is limited to tenants with multiple workspaces where builders exist; single-workspace deployments are effectively unaffected. The absence of a public exploit reduces immediate likelihood but does not diminish severity for exposed multi-workspace instances. EPSS has not yet been scored by FIRST.org; no EPSS value is available.

Detection Guidance

Sigma Rule

title: Budibase Cross-Workspace Chat-Links Enumeration (CVE-2026-100685)
id: 6f2b9c14-7d3a-4e21-9b55-0c9a1e4f8d21
status: experimental
description: Detects authenticated requests to the Budibase chat-links endpoint that may indicate cross-workspace enumeration of chat identity link records.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100685
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'GET'
  selection_uri:
    cs-uri-stem|contains: '/api/chat-links'
  condition: selection_method and selection_uri
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate builder access to chat links within their own workspace
level: medium
tags:
  - attack.t1213
  - cve.2026-100685

YARA Rule

rule CVE_2026_100685_Budibase_ChatLinks
{
    meta:
        description = "Detects Budibase chat-links endpoint references associated with CVE-2026-100685"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100685"
        date = "2026-01-01"
    strings:
        $endpoint = "/api/chat-links" ascii wide
        $product  = "budibase" ascii wide nocase
    condition:
        $endpoint or ($product and $endpoint)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100685 Budibase chat-links cross-workspace enumeration attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/chat-links"; nocase; classtype:attempted-recon; reference:cve,2026-100685; sid:2026100685; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where http.request.method == "GET" and
      url.path : "/api/chat-links" ]

Splunk SPL Query

index=web OR index=proxy
| search cs_method=GET uri_path="*/api/chat-links*"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri_path, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,accesslog,">
  <rule id="100685" level="7">
    <decoded_as>web-accesslog</decoded_as>
    <url>/api/chat-links</url>
    <description>CVE-2026-100685: Possible Budibase cross-workspace chat-links enumeration</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve_2026_100685,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Restrict builder role assignment: audit and minimize the number of users holding builder privileges across workspaces.
   • Enforce network-layer controls and reverse-proxy rules so that access to /api/chat-links is limited to trusted networks or authenticated contexts where possible.
   • Monitor and alert on repeated or anomalous authenticated GET /api/chat-links requests that return cross-workspace records (see Detection Guidance). Where feasible, temporarily block the endpoint at the proxy for non-administrative users until patched.
   • Enable detailed API/access logging to capture the calling user and the scope of returned records.

2. Patch/upgrade steps.

   • Upgrade Budibase to version 3.45.0 or later, which is the stated fixed boundary for this vulnerability.
   • Validate the upgrade in a staging environment and confirm that /api/chat-links responses are correctly scoped to the caller's workspace.
   • Rotate or review any external chat service integration credentials and identifiers that may have been exposed.

3. Long-term hardening.

   • Adopt a consistent authorization model that enforces workspace-scoping at the data-query layer for every endpoint, not only at the role check.
   • Add automated authorization tests (multi-workspace isolation tests) to CI/CD pipelines to catch broken-object/scope-level access control regressions.
   • Apply least-privilege role design and periodic access reviews for builder accounts.
   • Track the vendor advisory channel for a formal security fix and CVE update.

References

1. NVD — CVE-2026-100685: https://nvd.nist.gov/vuln/detail/CVE-2026-100685
2. Budibase official site / release notes (verify 3.45.0 release): https://budibase.com
3. CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
4. MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
5. CISA Known Exploited Vulnerabilities Catalog (verify status; not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence have been identified for CVE-2026-100685 at the time of writing.