CVE-2026-100686

Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant...

CVE-2026-100686 Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps

Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant...

EUVD-2026-87659

Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant...

CVE-2026-100686 Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps

Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant...

CVE-2026-100686

Budibase versions before 3.45.0 are vulnerable to a cross-workspace privilege escalation due to a failure to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint. An attacker with builder privileges in a single workspace can exploit these missing checks to modify u...

EUVD-2026-87658

Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data includin...

CVE-2026-100685 Budibase before 3.45.0 Information Disclosure via Chat Links

Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data includin...

CVE-2026-100685 Budibase before 3.45.0 Information Disclosure via Chat Links

Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data includin...

CVE-2026-100685

Budibase versions before 3.45.0 are vulnerable to an information disclosure flaw because the GET /api/chat-links endpoint fails to properly scope results by workspace. This oversight allows users with builder access to a single workspace to enumerate sensitive chat identity linking records—includ...

CVE-2026-100685 Budibase before 3.45.0 Information Disclosure via Chat Links

Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data includin...

CVE-2026-100685

Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data includin...

CVE-2026-100683

Budibase @budibase/server before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string backtick-quoted for MySQL, a single-quoted sprename literal for MSSQL without applying the project's...

CVE-2026-100680

Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI specifications submitted to the import...

CVE-2026-100677 stoatchat before 0.15.5 Account Enumeration via Error Location

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST...

CVE-2026-100677 stoatchat before 0.15.5 Account Enumeration via Error Location

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST...

EUVD-2026-87650

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST...

CVE-2026-100677 stoatchat before 0.15.5 Account Enumeration via Error Location

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST...

CVE-2026-100677

Versions of stoatchat before 0.15.5 are vulnerable to an account enumeration vulnerability within the login endpoint. Unauthenticated attackers can distinguish between registered and unregistered email addresses by analyzing the error location fields returned during POST /api/auth/session/login r...

CVE-2026-100654 vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids

vLLM before 0.29.0 accepts user-controlled stoptokenids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range. When mintokens 0, the stop token ids a...

CVE-2026-100647

Versions of vLLM before 0.29.0 are vulnerable to a Denial of Service (DoS) due to an Improper Input Validation flaw in the cache_salt parameter. The application fails to enforce a maximum length on this parameter across multiple API endpoints, including OpenAI-compatible and Anthropic handlers. A...