---
id: "CVE-2026-115502"
kind: "vulnerability"
aliases: ["CVE-2026-115502"]
title: "KNIME Business Hub: DataApp share links expose other users' jobs"
severity: "medium"
cvss: 6.3
epss: 0.00277
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["data-apps", "knime", "knime-business-hub", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-10-22T17:16:59+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T04:01:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115502", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115502", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# KNIME Business Hub: DataApp share links expose other users' jobs

A missing authorization check in KNIME Business Hub before 1.19.0 lets anyone holding a 'link without login' for a DataApp list and potentially access jobs of other users created through the same link. An attacker with such a link can see another user's job data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed KNIME Business Hub version against `1.19.0`
- Review whether any DataApps have 'link without login' sharing enabled in the Business Hub admin or DataApp settings

## Fix

- Upgrade KNIME Business Hub to `1.19.0` or later
- Until patched, remove all 'links without login' to DataApps, as the source advises

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115502
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115502

## From the sources

A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_