PatchSiren cyber security CVE debrief
CVE-2026-28444 baptisteArno CVE debrief
CVE-2026-28444 is an IDOR vulnerability in Typebot versions 3.15.2 and prior. The getResultLogs API endpoint authorizes callers against the provided typebotId but fetches logs solely by resultId without verifying that the result belongs to the authorized typebot. This oversight allows an authenticated attacker to supply their own typebotId alongside any victim's resultId to read execution logs from other workspaces, leaking sensitive data. The issue has been fixed in version 3.16.0.
- Vendor
- baptisteArno
- Product
- typebot.io
- CVSS
- MEDIUM 6.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-22
- Original CVE updated
- 2026-07-23
- Advisory published
- 2026-05-22
- Advisory updated
- 2026-07-23
Who should care
Users of Typebot versions 3.15.2 and prior should be aware of this IDOR vulnerability and take steps to protect their workspaces. This includes updating to version 3.16.0 or later, monitoring for suspicious activity, and restricting access to sensitive data.
Technical summary
The getResultLogs API endpoint in Typebot versions 3.15.2 and prior is vulnerable to IDOR. The endpoint authorizes callers against the provided typebotId but does not verify that the resultId belongs to the authorized typebot. This allows an authenticated attacker to read execution logs from other workspaces by supplying their own typebotId and a victim's resultId, potentially exposing HTTP response bodies, AI model outputs, and webhook payloads.
Defensive priority
Medium
Recommended defensive actions
- Update Typebot to version 3.16.0 or later
- Monitor for suspicious activity
- Restrict access to sensitive data
- Implement additional logging and monitoring
- Review compensating controls for exposed systems
- Check relevant monitoring, detection, and logs for exposed assets
- Track exceptions and retest remediated assets
Evidence notes
The CVE record was published on 2026-05-22T17:16:45.970Z and last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD details. Defenders should verify affected Typebot deployments and review execution logs for sensitive data exposure.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-05-22T17:16:45.970Z and has not been modified since then. The NVD entry is currently Deferred.