Cross-workspace OAuth credential takeover in TypeBot (CVE-2026-48765)

TypeBot contains an object-level authorization failure in `handleUpdateOAuthCredentials()` whereby a low-privilege read collaborator can extract an OAuth `credentialsId` from a readable bot configuration and then overwrite that credential record by supplying an attacker-controlled writable `workspaceId`. The handler validates write access only against the caller-supplied workspace and updates the credential by global `id` alone, without verifying that the credential belongs to the workspace being checked. This allows an attacker to hijack OAuth credentials from a victim workspace and reassign them to a workspace under the attacker's control. Affected versions: - <= 3.16.1 We recommend updating to: 3.16.2. CVSS 9.9 · our assessment: act_now Reference: https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-3788-7276-x4j4 Details: https://vuln.today/cve/CVE-2026-48765