CVE-2026-48767

Received Received - Intake

Google OAuth Token Exposure in TypeBot

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper `getAccessToken`. The vulnerable path checks only whether the caller has read access to the workspace, decrypts the stored Google OAuth credential, refreshes or retrieves the access token through the Google client, and returns the raw bearer token directly to the caller. Because guest members can also enumerate credential identifiers, a guest can mint and reuse the workspace's Google access token outside Typebot. Version 3.17.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-11

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-48767

EUVD

EUVD-2026-56782

Affected Vendors & Products

Vendor	Product	Version / Range
typebot	typebot	to 3.17.0 (exc)
baptistearno	typebot	to 3.17.0 (exc)
baptistearno	typebot	From 3.16.2 (inc)
baptistearno	typebot	3.17.0
baptistearno	typebot	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in TypeBot versions before 3.17.0 allows a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token by calling the getAccessToken function. The system only checks for read access to the workspace and then returns the raw OAuth token directly to the caller without additional authorization checks.

Detection Guidance

Check Typebot versions prior to 3.17.0 for the presence of guest members in workspaces with Google Sheets integrations. Inspect logs for unauthorized calls to getAccessToken by guest users. Verify if OAuth tokens are exposed outside Typebot by monitoring network traffic for raw token transmissions.

Impact Analysis

A guest member could use the stolen OAuth token to access or modify Google Sheets data associated with the workspace outside of TypeBot. This could lead to unauthorized data exposure, manipulation of sensitive information, or further attacks leveraging the compromised token.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. It may result in data breaches, non-compliance penalties, and loss of trust.

Mitigation Strategies

Upgrade Typebot to version 3.17.0 or later to patch the vulnerability. Remove guest members from workspaces with Google Sheets integrations. Rotate all exposed Google OAuth tokens and revoke any unauthorized access.

Hi! I’m here to help you understand CVE-2026-48767. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70