Live › vulnerability › CVE-2026-115502
Go to dashboardA missing authorization check in KNIME Business Hub before 1.19.0 lets anyone holding a 'link without login' for a DataApp list and potentially access jobs of other users created through the same link. An attacker with such a link can see another user's job data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running KNIME Business Hub before 1.19.0 that have shared DataApps through links that do not require login. Installations with no such links exposed are not reachable through this flaw, according to the workaround advice.
No product ranges from the sources yet.
1.19.01.19.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps.
This page as .md · .json · in your agent: get_signal("CVE-2026-115502")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.