CVE-2026-28444

Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the getResultLogs API endpoint authorizes the caller against the provided typebotId but fetches logs solely by resultId without verifying that the result belongs to the authorized typebot, leading to IDOR. An authenticated attacker can supply their own typebotId alongside any victim's resultId to read execution logs from other workspaces, leaking sensitive data including HTTP response bodies, AI model outputs, and webhook payloads. Every other result-scoped endpoint in the same router properly validates that the resultId belongs to the authorized typebotId. This confirms the missing check is an oversight, not a design choice. This issue has been fixed in version 3.15.2.

• CWE-639

• https://github.com/baptisteArno/typebot.io/commit/d82b2d47c86ae614a08d4073c669ca64442faff2
• https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0
• https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-c63p-mqx5-75r7

Published

May 22, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28435cpp-httplib is a C++11 single-file header-only cross platfor…7.5
• CVE-2026-28436Frappe is a full-stack web application framework. Prior to v…7.2
• CVE-2026-28438CocoIndex is a data transformation framework for AI. Prior t…9.8
• CVE-2026-2844Missing Authentication for Critical Function vulnerability i…7.5
• CVE-2026-28442ZimaOS is a fork of CasaOS, an operating system for Zima dev…8.5
• CVE-2026-28443OpenReplay is a self-hosted session replay suite. Prior to v…9.8
• CVE-2026-28445Typebot is a chatbot builder tool. In versions 3.15.2 and pr…8.7
• CVE-2026-28446OpenClaw versions prior to 2026.2.1 with the voice-call exte…9.8
• CVE-2026-28447OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.1 contain…6.5
• CVE-2026-28448OpenClaw versions 2026.1.29 prior to 2026.2.1 contain a vuln…9.4
• CVE-2026-28449OpenClaw versions prior to 2026.2.25 lack durable replay sta…6.5
• CVE-2026-2845An issue has been discovered in GitLab CE/EE affecting all v…6.5