---
id: CVE-2026-115502
title: >-
  DataApp links without logging expose job information to other user in KNIME
  Business Hub
summary: >-
  A missing authorization check allows anyone having access to a "link without
  login" for a DataApp to list and potentially access jobs of other users
  created by the same link in KNIME Business Hub prior to 1.19.0. As workaround
  remove all…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: KNIME
product: KNIME Business Hub
affected:
  - business_hub < 1.19.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-22T18:30:52.806799Z'
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T19:00:30.801Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115502'
references:
  - url: 'https://www.knime.com/security/advisories'
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.372Z'
---

## Overview

A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps.

## Affected

- `business_hub < 1.19.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.