CVE-2026-115502 in Business Hub
Summary
by MITRE • 10/23/2026
A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified involves a critical missing authorization check within the KNIME Business Hub software, specifically affecting versions prior to 1.19.0. This flaw resides in the handling of data applications that are configured with public access links, commonly referred to as link without login configurations. In such setups, users can generate shareable URLs that allow external parties or unauthenticated individuals to interact with specific DataApps hosted on the platform. The core technical deficiency lies in the server-side validation logic associated with these public endpoints. When a request is made via one of these shared links, the application fails to verify whether the requesting entity has legitimate authorization to view or manipulate resources belonging to other users who share the same access link configuration. This absence of proper object-level permission checks creates an insecure direct object reference scenario where the system trusts the presence of the valid public token without validating the scope and ownership boundaries of the requested data operations.
From a technical perspective, this vulnerability enables unauthorized enumeration and potential exfiltration of job metadata and results created by other users under the same link configuration. An attacker who obtains access to such a public link can iterate through resource identifiers or exploit predictable patterns in request parameters to list jobs belonging to different tenants or user accounts within that shared context. This capability goes beyond simple information disclosure, as it may allow for further exploitation depending on the sensitivity of the job data, which could include proprietary algorithms, sensitive business logic outputs, or personally identifiable information if processed by those jobs. The attack vector is straightforward and does not require complex exploit development; merely possessing a valid public link to any DataApp configured in this manner provides the initial foothold necessary to probe for cross-user visibility of resources.
The operational impact of this vulnerability is significant for organizations relying on KNIME Business Hub for collaborative data science workflows where multiple teams or users might inadvertently share access configurations. The ability to list and potentially access jobs from other users undermines the fundamental principles of multi-tenancy and data isolation that enterprise platforms must enforce. This can lead to severe confidentiality breaches, intellectual property theft, and non-compliance with regulatory standards such as GDPR or HIPAA if sensitive data is exposed. Furthermore, it erodes trust in the platform's security model, potentially forcing organizations to restrict collaboration features or revert to less efficient manual sharing methods that lack auditability. The risk is compounded by the fact that public links are often distributed widely through emails, chat applications, or web pages, increasing the attack surface and the likelihood of exposure to malicious actors who may actively scan for such misconfigurations.
To mitigate this vulnerability, organizations running KNIME Business Hub versions prior to 1.19.0 should immediately implement the recommended workaround by removing all links without login access to DataApps. This action effectively neutralizes the attack vector by eliminating the public entry points that lack proper authentication and authorization checks. For long-term resolution, it is imperative to upgrade to version 1.19.0 or later, where this missing authorization check has been addressed in the software's codebase. Additionally, security teams should review existing DataApp configurations to ensure that future deployments adhere to the principle of least privilege, ensuring that public access is only granted when absolutely necessary and accompanied by robust identity verification mechanisms. Regular audits of shared resources and monitoring for unusual enumeration patterns can also help detect potential exploitation attempts before significant data loss occurs. This incident highlights the importance of rigorous input validation and context-aware authorization checks in web applications to prevent insecure direct object references from leading to broader security compromises.