Description

Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data including user IDs and external chat service identifiers from other workspaces they have no permission to access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-26T14:16:52.860Z",
  "pubdate": "2026-09-26T14:16:52.860Z",
  "executiveSummary": "Budibase versions prior to 3.45.0 contain a critical Authorization Bypass vulnerability categorized as an Insecure Direct Object Reference (IDOR).\nThe flaw exists within the /api/chat-links endpoint, which fails to implement proper server-side scoping to restrict data access based on the requester's workspace membership.\nA malicious actor possessing legitimate 'builder' level access to a single workspace can exploit this oversight to perform unauthorized enumeration of chat identity link records across the entire tenant infrastructure.\nThis exposure results in the unauthorized disclosure of sensitive data, specifically mapping internal user identifiers to external chat service identities.\nThe vulnerability effectively collapses logical workspace boundaries, allowing for cross-workspace data exfiltration.\nRisk is significant, as it permits attackers to harvest organizational metadata and PII associated with external integrations without requiring escalated privileges beyond standard builder access.",
  "technicalDetails": "The vulnerability resides within the /api/chat-links API endpoint, which is responsible for managing and retrieving associations between Budibase user accounts and external chat platform identities.\nThe root cause is a failure in the application's backend logic to enforce workspace-level authorization checks during the processing of GET requests. While the API is intended to restrict results to the current user's workspace context, the implementation lacks an explicit filter condition or a validation check to correlate the requested resource identifiers with the caller's authorized scope.\nExploitation is straightforward for an authenticated user with builder privileges. Upon authentication, the attacker interacts with the /api/chat-links endpoint. Because the server-side code does not validate if the requested chat-link records belong to the caller's workspace, the database query executes with global tenant scope rather than scoped by workspace ID.\nThe attack flow follows a predictable pattern: first, the attacker establishes a valid session as a workspace builder. Second, the attacker sends a crafted GET request to /api/chat-links. Third, the application backend processes the request and returns a JSON payload containing chat identity link records spanning the entire tenant environment, including workspaces the attacker is not authorized to access.\nThis vulnerability highlights a flaw in the API access control layer where global object lookup bypasses the necessary multi-tenant isolation mechanisms. By iterating through the returned records, an attacker can map sensitive cross-functional user IDs to external chat identifiers, facilitating further reconnaissance or targeted social engineering campaigns. The lack of parameter validation or attribute-based access control (ABAC) on the endpoint allows the retrieval of records that should be invisible to unauthorized participants.\nAffected versions are limited to Budibase builds prior to 3.45.0. Successful exploitation requires an active session, but does not require administrative privileges beyond standard builder access, making it a high-utility vector for internal threat actors or compromised low-privileged accounts."
}