Typebot CVE-2026-39968

The attacker must hold a valid authenticated Typebot account (PR:L) on the target instance - any tenant-level account is sufficient; workspace membership in the target workspace is NOT required. The target deployment must run Typebot version 3.15.2 or earlier and expose the bot-engine preview chat endpoints (/v1/typebots/{typebotId}/preview/startChat and /v1/sessions/{sessionId}/continueChat). Exploitation requires sending a request with the client-controlled workspaceId field set to an empty string (allowed by the Zod schema) and referencing a typebot configuration that consumes credentials from the victim workspace. Limiting factors: instances with closed signup and tightly controlled user provisioning materially reduce the practical attack surface, and no user interaction is needed (UI:N) once authenticated.

The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflects network-reachable, low-complexity exploitation requiring only low-privilege authentication, with high confidentiality impact (stolen credentials) and limited integrity impact (abuse of those credentials downstream). The vulnerability is not listed in CISA KEV and no EPSS score was provided, so it is not confirmed actively exploited; however, the GitHub Security Advisory and a public patch commit (d96f572) reveal the exact code path, lowering the bar to weaponization. The risk is meaningfully higher than CVSS alone suggests for any multi-tenant or shared Typebot deployment, because PR:L only requires any registered account - in self-hosted or SaaS scenarios where signup is open, that threshold is effectively trivial. Conflict to note: no EPSS or KEV evidence is provided, so prioritization should be driven by deployment exposure (multi-tenant vs. single-tenant) and the sensitivity of stored credentials rather than threat-intel signals alone.

An attacker registers a low-privilege Typebot account (or uses any existing tenant account), then crafts a request to the preview chat endpoint specifying workspaceId: "" along with a typebot reference that uses credentials from a victim workspace. The bot-engine's falsy-check authorization gate is bypassed, the runtime loads the victim's stored credentials (e.g., SMTP or third-party API keys), and integration blocks execute under those credentials - letting the attacker exfiltrate secrets or pivot to abuse the victim's external services. No public PoC is referenced in the advisory, but the patch diff makes the bypass mechanics explicit.