Threats tagged 'ghsa-j425-cpch-6j4p'

Budibase server versions before 3.45.0 contain an authorization flaw in the GET /api/chat-links endpoint. This flaw allows users with builder access in one workspace to enumerate chat identity link records across all workspaces within the same tenant. Sensitive information exposed includes user IDs and external chat service identifiers from other workspaces that the attacker should not have access to.