Typebot CVE-2026-47702

Exploitation requires the attacker to first obtain read access to the Typebot application database - specifically the ApiToken table - via a separate channel such as SQL injection, an exposed or stolen database backup, or insider/administrative database access; the vulnerability itself provides no independent network entry point. Given that access, no further conditions apply: tokens are stored in cleartext in default configurations of version 3.16.1, so they are directly usable with no cracking, decryption, or additional privilege. Limiting factors are that a valid API token must actually exist for a target user, and that installations which never provisioned API tokens have nothing to steal; the primary constraint on real-world exploitation is achieving the prerequisite database read, which is why CVSS assigns AC:H despite AV:N/PR:N.

This is a genuine but conditional risk. The published CVSS 4.0 base score is 9.1 (Critical) with AV:N/AC:H/PR:N and high confidentiality/integrity impact, but the AC:H and the description itself make clear exploitation is not self-contained: an attacker must first obtain database read access through a separate vector (SQLi, backup exposure, or insider access). It should therefore be treated as an impact amplifier that turns any database-disclosure event into full multi-user account takeover, rather than a directly remotely-exploitable flaw. No CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided, so there is no evidence of active or automated exploitation. The real-world priority is highest for organizations that self-host Typebot with internet-exposed or multi-tenant databases, or that retain database backups in less-controlled storage; for those operators the flaw meaningfully raises the blast radius of any lower-severity database bug, so patching should not be deferred even though the raw 9.1 overstates standalone exploitability. Note the SQLi tag describes a plausible enabling vector, not a confirmed separate SQL injection vulnerability in this CVE - verify independently.

An attacker exploits an unrelated SQL injection point, obtains a leaked database dump, or abuses insider database access to read the ApiToken table, and because tokens are stored in cleartext they immediately obtain valid bearer credentials for every user. They then send authenticated requests to the Typebot builder API with a stolen token (Authorization: Bearer <token>) to impersonate victims, exfiltrate or modify their bots and data - with no password or MFA challenge. No public exploit code is identified at time of analysis, and the AC:H reflects the required prior database access.