Medium
DataApp links without login expose job information to other user in KNIME Business Hub
A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps.
Announced Group revision 1
Original source ↗CVE-2026-115502
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-115502
KNIME Business Hub
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "KNIME",
"product": "KNIME Business Hub",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.19.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.19.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-115502
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #52632 · Revision 1
- Added to Heist Feed
- Publisher date