CVE-2026-28444
published 2026-05-22CVE-2026-28444: Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the getResultLogs API endpoint authorizes the caller against the provided typebotId but…
PriorityP341medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.32%
23.3th percentile
Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the getResultLogs API endpoint authorizes the caller against the provided typebotId but fetches logs solely by resultId without verifying that the result belongs to the authorized typebot, leading to IDOR. An authenticated attacker can supply their own typebotId alongside any victim's resultId to read execution logs from other workspaces, leaking sensitive data including HTTP response bodies, AI model outputs, and webhook payloads. Every other result-scoped endpoint in the same router properly validates that the resultId belongs to the authorized typebotId. This confirms the missing check is an oversight, not a design choice. This issue has been fixed in version 3.15.2.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| baptistearno | typebot.io | < 3.16.0 | 3.16.0 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cvelistv5v3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CVEList
Typebot: IDOR in Result Logs Endpoint Allows Cross-Workspace Data Disclosure
cvelistv5·2026-05-22·CVSS 6.5
CVE-2026-28444 [MEDIUM] CWE-639 Typebot: IDOR in Result Logs Endpoint Allows Cross-Workspace Data Disclosure
Typebot: IDOR in Result Logs Endpoint Allows Cross-Workspace Data Disclosure
Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the getResultLogs API endpoint authorizes the caller against the provided typebotId but fetches logs solely by resultId without verifying that the result belongs to the authorized typebot, leading to IDOR. An authenticated attacker can supply their own typebotId alongside any victim's resultId to read execution logs from other workspaces, leaking sensitive data including HTTP response bodies, AI model outputs, and webhook payloads. Every other result-scoped endpoint in the same router properly validates that the resultId belongs to the authorized typebotId. This confirms the missing check is an oversight, not a design choice. This issue has been fix
VulDB
baptisteArno typebot.io up to 3.15.x getResultLogs API Endpoint authorization
vuldb·2026-05-22
CVE-2026-28444 [LOW] baptisteArno typebot.io up to 3.15.x getResultLogs API Endpoint authorization
A vulnerability marked as problematic has been reported in baptisteArno typebot.io up to 3.15.x. The impacted element is an unknown function of the component getResultLogs API Endpoint. Performing a manipulation results in authorization bypass.
This vulnerability is cataloged as CVE-2026-28444. It is possible to initiate the attack remotely. There is no exploit available.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-22
Published