CVE-2026-48765

Received Received - Intake

TypeBot OAuth Credential Takeover via Workspace ID Manipulation

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth `credentialsId` from a readable bot configuration and then overwrite that credential through `handleUpdateOAuthCredentials()` by supplying an attacker-controlled writable `workspaceId`. The update path validates only the attacker-supplied workspace and then updates the credential record by global `id` alone, while also rewriting the credential's `workspaceId`. This allows cross-workspace OAuth credential takeover and reassignment. Version 3.17.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-48765

Affected Vendors & Products

Vendor	Product	Version / Range
typebot	typebot	to 3.17.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

TypeBot is a chatbot builder tool. Versions before 3.17.0 have a flaw where a low-privilege collaborator can extract a workspace OAuth credential ID from a bot configuration and then overwrite it by supplying a malicious workspace ID. This allows the attacker to take over and reassign OAuth credentials across different workspaces.

Detection Guidance

To detect this vulnerability, check TypeBot versions prior to 3.17.0 for unauthorized OAuth credential modifications. Review bot configurations for unexpected workspace ID changes in OAuth credentials. Inspect logs for suspicious credential update attempts or cross-workspace OAuth token assignments.

Impact Analysis

An attacker could gain unauthorized access to sensitive data or systems by hijacking OAuth credentials. This could lead to data breaches, unauthorized actions, or further compromise of connected services.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using affected versions may face compliance violations and potential penalties.

Mitigation Strategies

Upgrade TypeBot to version 3.17.0 or later to patch the vulnerability. Review bot configurations for unauthorized OAuth credential changes and revoke any suspicious credentials.

Hi! I’m here to help you understand CVE-2026-48765. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70