The vulnerability in the getResultLogs endpoint permits an authenticated attacker to read logs belonging to another typebot. The missing ownership check allows the attacker to supply a victim’s resultId along with their own typebotId and retrieve execution logs that may contain HTTP response bodies, AI model outputs, and webhook payloads. This is an IDOR weakness and results in inadvertent disclosure of potentially sensitive data. The flaw comes from the fact that the result‑scoped endpoint authenticates against typebotId but fails to confirm that the resultId belongs to the authorized typebotId.

The affected product is Typebot, a chatbot builder tool produced by baptisteArno. Version 3.15.2 and earlier are vulnerable. The issue was fixed in 3.15.2, but the release notes indicate that 3.16.0 is available as a newer patch. Users running any version before 3.15.2 must update to a fixed release.

The CVSS score is 6.5, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An authenticated attacker could exploit this IDOR by using valid credentials for a workspace, then submitting a crafted request that swaps typebotId. The exploit requires only knowledge of a valid resultId, which is typically visible in API responses. Due to the lack of a check to confirm ownership, any authenticated user can read others’ logs, leading to a confidentiality breach.