CVE-2026-47702
Received Received - Intake

API Token Exposure in TypeBot Database

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
TypeBot is a chatbot builder tool. In version 3.16.1, API tokens (bearer credentials used to authenticate against the builder API) are stored in the database as cleartext strings. An attacker who gains read access to the database (e.g., via SQL injection, backup exposure, or insider access) can extract all API tokens and impersonate any user without requiring a password or multi-factor authentication. Version 3.17.0 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-47702
EUVD
EUVD-2026-56152

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
baptistearno typebot 3.16.1
baptistearno typebot 3.17.0
baptistearno typebot to 3.17.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

TypeBot versions before 3.17.0 stored API tokens in plaintext in the database. An attacker with database access could extract these tokens and impersonate users without needing passwords or multi-factor authentication.

Detection Guidance

To detect this vulnerability, check if TypeBot version 3.16.1 or earlier is installed. Inspect the database for plaintext API tokens in the ApiToken model. Review logs for unauthorized database access attempts or unusual API token usage patterns.

Impact Analysis

If an attacker gains access to the database, they can steal API tokens and take over user accounts or workspaces. This could lead to unauthorized access, data theft, or misuse of the TypeBot service.

Compliance Impact

Storing API tokens in plaintext violates data protection principles by failing to protect sensitive authentication credentials. This could lead to non-compliance with GDPR, HIPAA, or other regulations requiring secure handling of authentication data.

Mitigation Strategies

Upgrade TypeBot to version 3.17.0 or later to enable API token hashing. Rotate all existing API tokens immediately to invalidate any potentially exposed credentials. Ensure database access controls are tightened to prevent unauthorized reads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47702. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart