In typebot.io versions before 3.16.0, the getResultLogs API endpoint suffers from an Insecure Direct Object Reference (IDOR) due to missing validation that the resultId belongs to the authorized typebotId. While the endpoint authorizes callers against the provided typebotId, it retrieves logs solely by resultId without confirming ownership, enabling an authenticated attacker to read logs from other users' workspaces. This leads to unauthorized disclosure of sensitive data including HTTP response bodies, AI model outputs, and webhook payloads. Other result-scoped endpoints correctly enforce this validation, confirming this was an implementation oversight. The vulnerability is fixed in version 3.16.0.

An authenticated attacker can bypass authorization controls to access execution logs from other users' workspaces, resulting in exposure of sensitive information such as HTTP response bodies, AI model outputs, and webhook payloads. This unauthorized data disclosure can compromise confidentiality but does not affect integrity or availability.

Upgrade typebot.io to version 3.16.0 or later, where the vulnerability has been fixed by adding proper validation to ensure that the resultId belongs to the authorized typebotId. No other mitigation is indicated or required.