Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data including user IDs and external chat service identifiers from other workspaces they have no permission to access. This flaw falls under CWE-863, improper access control, and results in a confidentiality breach.

Budibase server instances running any version prior to 3.45.0 are affected. Users granted builder permissions in any workspace can exploit the vulnerability by accessing the GET /api/chat-links endpoint, thereby enumerating link records from workspaces that the attacker should not be able to view.

The vulnerability carries a CVSS score of 8.3, indicating high severity, while the EPSS score is not available and it is not listed in the CISA KEV catalog. Attackers only need an authenticated builder token and can perform the exploit over the network via an HTTP GET request. Because the flaw is based on improper workspace scoping, the difficulty is low for users with the required role, making the risk of exploitation significant when such users exist on the system.