CVE-2026-42142
Received Received - Intake

TypeBot Google Sheets OAuth Credential Exposure via Unauthorized Access

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data (sheet names, IDs, column headers). Version 3.17.0 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-42142
EUVD
EUVD-2026-56235

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
baptistearno typebot to 3.17.0 (exc)
baptistearno typebot 3.16.2
baptistearno typebot 3.17.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-42142 is an authorization bypass vulnerability in the TypeBot chatbot builder. It affects the Google Sheets getSheets endpoint (POST /api/sheets/getSheets) in versions before 3.17.0. The issue allows any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data without proper workspace membership validation.

Detection Guidance

Check TypeBot server logs for unusual API requests to POST /api/sheets/getSheets with mismatched workspaceId and user credentials. Look for decryption attempts or unauthorized spreadsheet data access patterns.

Impact Analysis

An attacker with knowledge of a target workspace's workspaceId and credentialsId could bypass authorization checks. This enables unauthorized access to sensitive spreadsheet data, including sheet names, IDs, and column headers. The attacker could also decrypt OAuth credentials, potentially gaining ongoing access to Google Sheets data even after losing workspace membership.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection regulations like GDPR and HIPAA, which mandate strict access controls and protection of sensitive data. Unauthorized access to spreadsheet data containing personal or health information could result in regulatory penalties, data breach notifications, and reputational damage due to compromised confidentiality.

Mitigation Strategies
  • Upgrade TypeBot to version 3.17.0 or later to apply the authorization fix.
  • Review and revoke any potentially exposed Google Sheets OAuth credentials in affected workspaces.
  • Audit workspace memberships to ensure only authorized users have access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42142. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart