CVE-2026-28444 baptisteArno CVE debrief

Who should care

Users of Typebot versions 3.15.2 and prior should be aware of this IDOR vulnerability and take steps to protect their workspaces. This includes updating to version 3.16.0 or later, monitoring for suspicious activity, and restricting access to sensitive data.

Technical summary

The getResultLogs API endpoint in Typebot versions 3.15.2 and prior is vulnerable to IDOR. The endpoint authorizes callers against the provided typebotId but does not verify that the resultId belongs to the authorized typebot. This allows an authenticated attacker to read execution logs from other workspaces by supplying their own typebotId and a victim's resultId, potentially exposing HTTP response bodies, AI model outputs, and webhook payloads.

Defensive priority

Medium

Recommended defensive actions

• Update Typebot to version 3.16.0 or later
• Monitor for suspicious activity
• Restrict access to sensitive data
• Implement additional logging and monitoring
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-05-22T17:16:45.970Z and last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD details. Defenders should verify affected Typebot deployments and review execution logs for sensitive data exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.