Typebot CVE-2026-48766

The attacker must hold a valid guest-level (read-access) membership in a Typebot workspace that has at least one OpenAI-compatible API credential stored. Guest membership can be legitimately granted by workspace administrators or obtained through account compromise. The vulnerable endpoint (handleListModels) must be reachable over the network, which is the default configuration for the Typebot builder application. Exploitation is limited to workspaces where stored credentials exist - workspaces with no configured OpenAI integrations are not at risk of API key theft. The attack does not require write privileges, administrator access, or any special feature flags; the default guest role is sufficient. What limits exploitation is the requirement of prior workspace membership: the attacker cannot exploit this against arbitrary Typebot instances without first obtaining a guest account in the target workspace.

The CVSS 3.1 score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) accurately reflects the attack surface: network-accessible, low complexity, requiring only low-privilege authentication. The C:H rating is well justified because the exfiltrated credential is a workspace-level OpenAI API key, which could enable significant downstream abuse including LLM API cost fraud or data exposure via the key owner's OpenAI account. The I:L and A:L ratings reflect secondary impacts from potential misuse of the exfiltrated key. EPSS data was not provided in the intelligence package, so exploitation probability cannot be quantified, though the attack's simplicity and the credential value make it a realistic target; even a mid-sized municipal IT team in zabrze managing a shared Typebot workspace should treat this as urgent given how easily guest accounts can be obtained. No KEV listing exists at time of analysis. The vulnerability is not a zero-day - a patch is available in v3.17.0 - and the attack requires an account in the target workspace, which limits opportunistic mass exploitation but not targeted insider or supply-chain attacks.

An attacker who has been granted guest membership in a target Typebot workspace - or who compromises a guest account via phishing - enumerates credential identifiers using the listCredentials endpoint, then calls the handleListModels API endpoint with a credentialsId pointing to a stored OpenAI API key and sets baseUrl to an attacker-controlled server. The Typebot server decrypts the workspace secret and issues an HTTP request to the attacker's server with the API key embedded in both the Authorization and api-key headers, completing the exfiltration without any further interaction. No public proof-of-concept has been identified, but the attack requires only standard HTTP tooling and workspace guest credentials.