Which versions of Typebot are affected by CVE-2026-48494?

Typebot 3.16.1 and earlier versions contain a workspace isolation vulnerability where authenticated users in one organization can modify unpublished WhatsApp chatbots belonging to other organizations…

How to fix or mitigate CVE-2026-48494?

Within 24 hours, identify all Typebot instances running version 3.16.1 or earlier and audit for shared cross-workspace user accounts. Within 7 days, upgrade all affected Typebot deployments to version 3.17.0, validating WhatsApp integrations post-upgrade. Within 30 days, review WhatsApp preview session logs and webhook audit trails for unauthorized payload injections, and manually re-verify the integrity of any recently modified unpublished chatbot workflows.

Typebot CVE-2026-48494

Q: What is the CVSS score of CVE-2026-48494?

CVE-2026-48494 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-56780 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-11 security-advisories@github.com

Authentication Bypass

7.1

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-accessible with low-privilege authentication required; no scope change since impact stays within the application; integrity-only impact on victim's draft flow with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 11, 2026 - 19:37 vuln.today

Analysis Generated

Aug 11, 2026 - 19:37 vuln.today

CVE Published

Aug 11, 2026 - 18:17 cve.org

HIGH 7.1

DescriptionCVE.org

TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign preview phone number tied to another preview session. The WhatsApp test-webhook handler authorizes the parent typebot first, but then resolves the preview chat session only by wa-preview-{phone}. As a result, an attacker can inject arbitrary webhook JSON into another workspace's WhatsApp preview session and advance its draft/unpublished flow without any access to the victim typebot. Version 3.17.0 patches the issue.

AnalysisAI

Cross-workspace session hijacking in Typebot 3.16.1 allows an authenticated low-privileged user to inject arbitrary webhook payloads into another workspace's active WhatsApp preview session by supplying a valid typebotId they control alongside a victim's preview phone number. The WhatsApp test-webhook handler authorizes the caller against their own typebot but then resolves the target session exclusively by the phone-keyed session ID (wa-preview-{phone}), making no ownership binding between the resolved session and the requesting typebotId. As a result, an attacker can advance or corrupt another workspace's unpublished chatbot flow without any authorization on that typebot. No public exploit has been identified; patch is confirmed available in version 3.17.0.

Technical ContextAI

Typebot is an open-source chatbot-builder platform (typebot.io) built as a Node.js/TypeScript monorepo. The vulnerability resides in packages/blocks/webhook/src/api/handleExecuteTestWebhookWhatsApp.ts, the handler for WhatsApp integration preview/testing. The root cause is CWE-639 (Authorization Through User-Controlled Key): after confirming the caller holds access to the supplied typebotId, the handler performs a session lookup using only the caller-controlled phone number as the key (getSession('wa-preview-{phone}')). Because all WhatsApp preview sessions across all workspaces are stored under this same phone-derived namespace with no workspace or typebotId binding, the lookup can resolve a session belonging to an entirely different workspace. The fix (commit 36a618610174fd168fb255d9c8ecc0d2cf61a192, PR #2499) adds a cross-ownership validation: after the session is retrieved, it asserts that chatSession.state.typebotsQueue[0]?.typebot.id = typebotId and chatSession.state.currentBlockId = blockId, ensuring the resolved session actually belongs to the requested typebot before any webhook processing occurs.

RemediationAI

Upgrade to Typebot version 3.17.0, which contains the patch for this vulnerability. The release is available at https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0 and the fix is implemented in commit 36a618610174fd168fb255d9c8ecc0d2cf61a192 via PR #2499. The patch adds session-ownership validation that cross-checks the resolved chat session's stored typebotId and blockId against the values supplied in the webhook request, preventing session resolution across workspace boundaries. If an immediate upgrade to 3.17.0 is not feasible, a compensating control is to restrict access to the WhatsApp preview webhook endpoint to internal or trusted network ranges only, accepting the trade-off that remote WhatsApp preview testing will be unavailable to users outside that network. Disabling the WhatsApp integration feature entirely eliminates the attack surface at the cost of all WhatsApp preview functionality. There is no documented configuration toggle that neutralizes the vulnerability while preserving full WhatsApp preview capabilities prior to patching.