What is the CVSS score of CVE-2026-48766?

CVE-2026-48766 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Typebot are affected by CVE-2026-48766?

Typebot versions prior to 3.17.0 contain a credential exfiltration vulnerability affecting authenticated guest workspace users.. A patch is available.

How to fix or mitigate CVE-2026-48766?

Within 24 hours, disable guest workspace access in all Typebot instances, or restrict guest roles to exclude permissions on API credential and model configuration endpoints; simultaneously audit access logs for the model-listing endpoint to identify suspicious baseUrl parameters or redirect patterns. Within 7 days, rotate all OpenAI and OpenAI-compatible API keys across Typebot instances, implement IP allowlisting or rate-limiting on these credentials at the provider level if available, and revoke guest workspace accounts that lack explicit business justification. Within 30 days, upgrade to Typebot version 3.17.0 or later when released by the vendor, implement credential scanning in your CI/CD pipeline to prevent accidental credential storage, and review access control policies to enforce least-privilege principles for guest-level roles across all integrations.

Typebot CVE-2026-48766

EUVD-2026-56238 HIGH

Information Exposure (CWE-200)

2026-08-11 GitHub_M

Information Disclosure Typebot Io Baptistearno

7.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

vuln.today AI

7.6 HIGH

Network-reachable endpoint requiring only low-privilege guest auth; C:H for full API key exfiltration; I:L and A:L for indirect downstream key misuse.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Aug 11, 2026 - 17:02 EUVD

Source Code Evidence Fetched

Aug 11, 2026 - 16:34 vuln.today

Analysis Generated

Aug 11, 2026 - 16:34 vuln.today

CVE Published

Aug 11, 2026 - 15:55 cve.org

HIGH 7.6

DescriptionCVE.org

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled baseUrl. The vulnerable path decrypts the selected workspace credential, creates an OpenAI client with the secret in both apiKey and the explicit api-key header, and then sends the outbound request to the caller-supplied URL. Because the permission check accepts any readable workspace member and listCredentials reveals credential identifiers to guests, a guest can force the server to deliver the workspace secret to attacker infrastructure. Version 3.17.0 patches the issue.

AnalysisAI

Credential exfiltration in Typebot prior to 3.17.0 allows a low-privilege guest workspace member to steal decrypted OpenAI-compatible API keys by invoking the model-listing endpoint with an attacker-controlled baseUrl. The server decrypts the stored credential and forwards the secret in both the Authorization header and an explicit api-key header to whatever URL the guest supplies, effectively acting as a credential-delivery proxy. This vulnerability has no public exploit identified at time of analysis, but the attack is trivially exploitable by any authenticated workspace guest with read access.

Technical ContextAI

Typebot (CPE: cpe:2.3:a:baptistearno:typebot.io:*:*:*:*:*:*:*:*) is an open-source chatbot builder that supports OpenAI-compatible integrations. The vulnerable component is the handleListModels API handler (apps/builder/src/features/blocks/integrations/openai/api/handleListModels.ts), which decrypts workspace credentials from the database and constructs an OpenAI client using the plaintext secret. Before the fix, this handler used isReadWorkspaceForbidden as its authorization gate, meaning any guest member with read access could invoke it. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) precisely characterizes the root cause: the authorization boundary did not prevent read-privileged users from triggering an operation that exposes highly sensitive material (API keys) to attacker-controlled infrastructure. The companion fix to handleGetAccessToken.ts applied the same privilege escalation correction to Google Sheets OAuth tokens, suggesting a systemic pattern of overly permissive read-gate usage across integration handlers.

RemediationAI

Upgrade to Typebot version 3.17.0, which is confirmed available at https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0. This release replaces the isReadWorkspaceForbidden permission check with isWriteWorkspaceForbidden in both handleListModels.ts and handleGetAccessToken.ts, ensuring that only workspace members with write privileges can trigger credential-decrypting operations. If immediate upgrade is not possible, a compensating control is to remove all guest-role members from workspaces that store OpenAI-compatible credentials until patching is complete; this eliminates the low-privilege attack surface at the cost of losing guest collaboration capability. Alternatively, rotating all stored OpenAI API keys and replacing them with keys scoped to minimum necessary permissions limits the blast radius if exfiltration has already occurred. The GitHub pull request with the full diff is at https://github.com/baptisteArno/typebot.io/pull/2459 and the fixing commit is 7ae4c007d0987d2ca907b47e1b7418db62b8a157.