CVE-2026-62861

Deferred Deferred - Pending Action

TypeBot Custom Domain Unauthorized Removal Vulnerability

Publication date: 2026-08-25

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler in handleDeleteCustomDomain.ts authorizes a caller against a client-supplied workspaceId but sends the client-supplied domain name to the shared Vercel project before verifying that the domain belongs to that workspace. This issue is fixed in version 3.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-09-09

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-62861

Affected Vendors & Products

Vendor	Product	Version / Range
typebot	typebot	3.18.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

TypeBot is a chatbot builder tool. Prior to version 3.18.0, an authenticated non-guest workspace member could remove another workspace's public custom domain, making typebots on that domain unavailable. The issue was in the custom-domain delete handler which authorized a caller against a client-supplied workspaceId but sent the domain name to the shared Vercel project before verifying domain ownership.

Detection Guidance

This vulnerability affects TypeBot versions prior to 3.18.0 and involves unauthorized removal of custom domains. To detect it, check TypeBot server logs for suspicious domain deletion requests or verify the TypeBot version installed. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to disrupt or take down chatbots hosted on a custom domain by removing the domain association. This could lead to service unavailability, reputational damage, or loss of business functionality for affected users.

Compliance Impact

The vulnerability allows unauthorized users to remove public custom domains, potentially disrupting access to typebots. This could impact compliance by causing data processing disruptions or unauthorized access to sensitive information, depending on how the domain is used. However, specific compliance impacts are not detailed in the provided context.

Mitigation Strategies

Update TypeBot to version 3.18.0 or later to address the vulnerability. Ensure only authorized users can modify custom domains and verify domain ownership before allowing deletions.

Hi! I’m here to help you understand CVE-2026-62861. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70