Hi, we have several automations under development, each of which were fine last week.  Today, we wanted to change the name of one of them, so attempted to open the automation settings, and it raised the alert "Unauthorized: You do not have access to this automation. Contact your system administrator for more information."
We have tried opening these settings on other automations, and get exactly the same.  Edits to the automation blocks are working fine, so why are they being shown as unauthorized for the settings?

Note:  I am the administrator and, as far as I can see, the account attempting to open the automation settings is the owner of the automation, and no roles or permissions have been changed between last week and this.

Thanks.

Hi everyone!

If you develop in Qlik Sense, you know the scene: the load script changed, the number on the dashboard changed with it, and nobody knows who changed it, when or why. To solve this, we built Versiona CuboPlus, a free extension for Chrome and Edge that keeps the history of your load script in your company's Git repository.

Intro video: 

How it works

• You open the app in Qlik, and a mascot tells you when the script has changed and has no version yet.
• You write what changed and why, and the version becomes a commit in GitLab or GitHub, with you as the author.
• You can see the line-by-line differences before saving, browse the history and restore a previous version.
• Optional: the expressions of master measures and dimensions and the app variables go along, in a file next to the script (read-only).

Where it works

• Qlik Sense Enterprise on Windows and Qlik Cloud.
• GitLab, including self-managed, and GitHub.
• In English, Portuguese and Spanish.

Security

• The script goes from your browser straight to Qlik and to the Git you configured: it goes through no other server, and there is no telemetry.
• The extension does not write to public repositories: the repository must be private.
• The Git token is encrypted in the browser, and you can require the Windows Hello PIN or biometrics to use it.
• IT can distribute the configuration by policy (GPO).

For client-managed, there is also an optional nightly routine in PowerShell for GitLab, open source, that stores overnight whatever changed without going through the extension.

Download and more

• Versiona CuboPlus on the Chrome Web Store
• versiona.cubo.plus
• Setup and security guide

It is free. If you try it, tell us here what you think, and leave a review on the Chrome Web Store.

Suggestions and bug reports are very welcome.

Follow CuboPlus on Instagram: @cubo.plus

I'm trying to setup a block to retrieve trust score information from datasets in my tenant. According to documentation I need to use a Qlik Cloud Services - Raw API Request and point to  

api/data-governance/trust-scores/results/data-sets/actions/filter

After running the automation this is the response

{ "response": { "status": 404, "body": { "error": "Unknown Service (url: https://mytenantid.us.qlikcloud.com/api/data-governance/trust-scores/results/data-sets/actions/filter)" } }, "external error": false }

I've tried using curl to call this endpoint externally and it works fine. 

Olá, pessoal!

Quem desenvolve no Qlik Sense conhece a cena: o script de carga mudou, o número do painel mudou junto, e ninguém sabe quem alterou, quando nem por quê. Para resolver isso, criamos o Versiona CuboPlus, uma extensão gratuita para Chrome e Edge que guarda o histórico do script de carga no repositório Git da sua empresa.

Vídeo de apresentação:

Como funciona

• Você abre o app no Qlik, e um mascote avisa quando o script mudou e ainda não tem versão.
• Você escreve o que mudou e por quê, e a versão vira um commit no GitLab ou no GitHub, com o seu nome como autor.
• Dá para ver as diferenças linha a linha antes de salvar, consultar o histórico e restaurar uma versão anterior.
• Opcional: as expressões das medidas e dimensões mestres e as variáveis vão junto, num arquivo ao lado do script (só leitura).

Onde funciona

• Qlik Sense Enterprise on Windows e Qlik Cloud.
• GitLab, inclusive instalado na empresa, e GitHub.
• Em português, inglês e espanhol.

Segurança

• O script vai do seu navegador direto para o Qlik e para o Git que você configurou: não passa por nenhum servidor diferente do que configurou, e não há telemetria.
• A extensão não grava em repositório público: o repositório precisa ser privado.
• O token do Git fica criptografado no navegador, e dá para exigir o PIN ou a biometria do Windows Hello para usá-lo.
• O TI pode distribuir a configuração por política (GPO).

Para quem usa client-managed, há também uma rotina noturna opcional em PowerShell para GitLab, com o código aberto, que guarda de madrugada o que mudou sem passar pela extensão.

Onde baixar e sobre

• Versiona CuboPlus na Chrome Web Store
• versiona.cubo.plus
• Guia de configuração e segurança 

É gratuito. Se testarem, contem aqui o que acharam e deixem uma avaliação na Chrome Web Store.

Sugestões e relatos de problema são muito bem-vindos.

Sigam a CuboPlus no Instagram: @cubo.plus

From https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497

Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code.

Who is affected: anyone running Node.js or Bun whose app decompresses Brotli data that an attacker could control.

Ok, so Qlik Sense Enterprise on Windows runs on Node.js 24.14.1.
I have the following questions:

1. Does the specific implementation of a vulnerable Node.js version in Qlik Sense Enterprise on Windows implicate a threat to installations of Qlik Sense?

2. Are there any migitating actions that can be undertaken by administrators to continue operating safely until Qlik Sense/Node.js is patched?

3. Is there a patch coming? If so, when is this expected to be made available?

Qlik Sense: standalone Node.js update following the October 2026 security release

Following the Node.js security release of October 21, 2026, including the Brotli vulnerability CVE-2026-111497, I tested updating the Node.js binary bundled with Qlik Sense independently of a Qlik patch.

The test passed on Qlik Sense Enterprise on Windows May 2026 Patch 7, updating Node.js 24.18.1 to 24.22.1 This is a result from one environment, not a compatibility guarantee for every deployment.

This method is not validated by Qlik. Qlik's documented approach is to update bundled Node.js through a Qlik Sense upgrade. Test in development first, with a maintenance window and a recoverable full backup.

Check your current bundled Node.js version

Run in PowerShell:

& "$env:ProgramFiles\Qlik\Sense\ServiceDispatcher\Node\node.exe" --version

Using the full path checks Qlik's copy rather than another Node.js installation on the PATH.

Run the scripts

1. Extract the attached scripts into one folder.
2. Download the [official Windows x64 node.exe](https://nodejs.org/dist/v24.22.1/win-x64/node.exe).
3. Edit `NodeUpdate.config.psd1`: set the binary, backup and log paths, and the official SHA256 for "win-x64/node.exe" from SHASUMS256.txt.
4. In Windows PowerShell 5.1 as administrator, run:

.\01_Backup_Node.ps1

Continue only after BACKUP VERIFIED.
.\02_Update_Node.ps1

Leave the Service Dispatcher running before Update: the script handles stopping and restarting it. Relative paths are resolved against the configuration folder; execution is local to each machine.

Test Hub, QMC, application access, exports, reloads and your usual connectors, and check Qlik logs. These are recommended checks, not a list of checks confirmed by the test above.

For rollback, set `RestoreBackupDirectory` to the exact original backup folder and run:

.\03_Restore_Node.ps1

The scripts target the main Service Dispatcher on Node.js 24 only. They do not update EAPowerTools, Package Cache or npm dependencies. A binary backup is not a full site backup, and automatic rollback is not guaranteed. Recheck the installed version after subsequent Qlik maintenance.

References:

• Qlik Support, article updated August 14, 2024, linked above
• The Node.js Project, October 21, 2026 security bulletin, linked above
• Node.js 24.22.1 release notes, October 21, 2026: https://nodejs.org/en/blog/release/v24.22.1

Hi,

Our Network Security team has recommended adding the following security headers to our Qlik Sense environment:

X-Frame-Options: Sameorigin/deny
X-XSS-Protection : 1; mode=block
X-Content-Type-Options : nosniff
Content-Security-Policy : script-src 'self'
X-Permitted-Cross-Domain-Policies
Referrer-Policy : no-referrer
Cross-Origin-Opener-Policy: same-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Cache-Control:
no-store, max-age=0
Pragma: no-cache

Has anyone implemented these headers in Qlik Sense Enterprise on Windows? I’d appreciate guidance on:

• Which headers are compatible with Qlik Sense, and whether any could affect the Hub, mashups, or extensions.
• Where each header should be configured, including whether any require a different approach.
• How to test the changes safely before applying them in production.

Thanks in advance!

Regards,

Tushar C.

Hi Qlik Community, 

¡IMPORTANT!

If you are on QAP and leverage anonymous authentication, do NOT upgrade to May 2026 Initial Release.

We have upgraded one of our TEST environments and noticed this issue:

even if the Virtual Proxy is configured to Allow Anonymous Users, they are being prompted for authentication.

So, please check your virtual proxy configuration before upgrading, or wait for the fix.

The Virtual proxies that are configured as Always anonymous users are working as expected.

@Giuseppe_Novello | @Sonja_Bauernfeind | @Ray_Strother 

@Eduardo_Monteiro | @SergioProba | @kauenascimento | @AnaSilva