CVE-2026-28444 Details
Description
Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the getResultLogs API endpoint authorizes the caller against the provided typebotId but fetches logs solely by resultId without verifying that the result belongs to the authorized typebot, leading to IDOR. An authenticated attacker can supply their own typebotId alongside any victim's resultId to read execution logs from other workspaces, leaking sensitive data including HTTP response bodies, AI model outputs, and webhook payloads. Every other result-scoped endpoint in the same router properly validates that the resultId belongs to the authorized typebotId. This confirms the missing check is an oversight, not a design choice. This issue has been fixed in version 3.15.2.
An authorization issue has been identified in Typebot versions through 3.15.2, specifically within the getResultLogs API endpoint. The vulnerability arises from the endpoint's failure to properly validate the ownership of result IDs in relation to the authorized Typebot IDs. This oversight allows authenticated attackers to access execution logs from other workspaces by supplying their own Typebot ID along with a victim's result ID. The exposed logs can contain sensitive information such as HTTP response bodies, AI model outputs, and webhook payloads. Notably, this vulnerability exists despite other result-scoped endpoints in the same router implementing proper validation, indicating that the issue is an unintentional oversight.
Users can update to Typebot version 3.16.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 22, 2026CISA-ADP
Assessed May 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/baptisteArno/typebot.io/commit/d82b2d47c86ae614a08d4073c669ca64442faff2 | [email protected] | Source CodeVendor |
| https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0 | [email protected] | Release NotesVendor |
| https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-c63p-mqx5-75r7 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Typebot | <= 3.15.2 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 22, 2026 | New CVE Received | [email protected] |