Typebot CVE-2026-48765

Exploitation requires an authenticated Typebot account (CVSS PR:L) that (1) holds at least read-collaborator access to a bot in the victim workspace so the OAuth credentialsId can be read from the bot configuration, and (2) has write access to a second workspace whose workspaceId the attacker supplies to pass the flawed authorization check in handleUpdateOAuthCredentials(). The limiting factors are these two prerequisites plus a multi-workspace deployment: a single-workspace instance with no external read collaborators is not exploitable, and fully anonymous exploitation is impossible because prior authenticated read access is mandatory.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L is internally consistent with the description: a network-reachable ORPC endpoint, low complexity, and only a low-privilege authenticated account (read collaborator) required, with a scope change reflecting that impact crosses the workspace security boundary. The 9.9 score is driven by that scope change plus high confidentiality and integrity impact. Real-world risk is meaningful for multi-tenant or shared self-hosted Typebot deployments where distinct workspaces hold sensitive OAuth tokens, but it is bounded by PR:L - the attacker must already be an authenticated user with at least read access to some bot, so this is not an anonymous internet-wide bug. No EPSS score, KEV listing, or POC was provided; the absence of KEV plus the need for prior authenticated access suggests this is not currently mass-exploited. There is no signal conflict in the data - the vector matches the described low-privilege authenticated IDOR.

An attacker is invited as a read-only collaborator to a bot in a victim workspace and separately owns or can write to their own Typebot workspace. They read the bot configuration to harvest the victim workspace's OAuth credentialsId, then call handleUpdateOAuthCredentials() supplying their own writable workspaceId plus the victim's credentialsId, causing the server to overwrite the credential and reassign it to the attacker's workspace. Given AV:N/AC:L this requires only crafted API calls with no user interaction; no public POC was identified at time of analysis.