Is CVE-2026-28444 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28444 being exploited in the wild.

How severe is CVE-2026-28444?

Medium severity, with a CVSS score of 6.5, published 22 May 2026.

Is there a fix for CVE-2026-28444?

A patch was published on 2026-04-08: Fixed in version 3.16.0 (referenced as 3.15.2 in some documentation) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28444 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-28444?

Check whether you run Typebot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28444: Typebot IDOR in getResultLogs API endpoint

CVE-2026-28444 · Severity: medium · CVSS 6.5 · Published 2026-05-22

Typebot, an open-source chatbot builder, contains a security flaw that allows authenticated users to view sensitive data belonging to other accounts. By exploiting a weakness in how the system verifies ownership of chat logs, an attacker could access private information such as AI model outputs, customer data from webhooks, and responses from integrated third-party services (like CRMs or payment processors). This could lead to the exposure of personal information or proprietary business data across different organizations using the platform.

Technologies: Typebot. Vendors: Typebot.

Quick answers

Is CVE-2026-28444 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28444 being exploited in the wild.
How severe is CVE-2026-28444?: Medium severity, with a CVSS score of 6.5, published 22 May 2026.
Which products and versions are affected?: Typebot <= 3.15.2.
Is there a fix for CVE-2026-28444?: A patch was published on 2026-04-08: Fixed in version 3.16.0 (referenced as 3.15.2 in some documentation) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28444 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-28444?: Check whether you run Typebot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An IDOR vulnerability exists in the `getResultLogs` API endpoint within `apps/builder/src/features/results/api/handleGetResultLogs.ts`. While the application correctly verifies that the authenticated user has access to the provided `typebotId`, it fails to validate that the requested `resultId` actually belongs to that specific Typebot. Because the database query for logs is scoped only by `resultId`, an attacker can provide their own authorized `typebotId` alongside a victim's `resultId` to bypass ownership checks. This allows for the retrieval of execution logs which may contain sensitive HTTP response bodies, AI model outputs, and webhook payloads. The issue was addressed by updating the Prisma query to enforce a join between the result and the authorized Typebot ID.

Affected products

baptisteArno typebot.io <= 3.15.2

Timeline

2026-05-22: advisory: GHSA-c63p-mqx5-75r7 published
2026-05-22: disclosed
2026-04-08: patched: Fixed in version 3.16.0 (referenced as 3.15.2 in some documentation)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.