CVE-2026-115502 — DataApp links without login expose job information to other user in KNIME Business Hub

CVE-2026-115502

DataApp links without login expose job information to other user in KNIME Business Hub PUBLISHED

Description (CNA)

A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps.

Affected (CNA)

Vendor / product	Versions
KNIME / KNIME Business Hub	affected 0 before 1.19.0; unaffected 1.19.0

CWE

CWE-862

References

https://www.knime.com/security/advisories

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.