10
CVEs
2
Critical
6
High
0
KEV
0
PoC
1
Unpatched C/H
90.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
6
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (3)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-48765 | Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding only read-collaborator access on a bot read a workspace's OAuth `credentialsId` and then overwrite that credential by calling handleUpdateOAuthCredentials() with an attacker-controlled writable `workspaceId`. Because the update authorized only the attacker's supplied workspace but then located and mutated the credential by its global `id` alone (and rewrote its `workspaceId`), a low-privilege user in one workspace can seize and reassign OAuth credentials belonging to another workspace. Rated CVSS 9.9; no public exploit identified at time of analysis, though the fixing commit and PR are public. | CRITICAL | 9.9 | 0.3% | 50 |
|
| CVE-2026-47702 | Cleartext storage of API bearer tokens in the self-hosted open-source Typebot chatbot builder (version 3.16.1) lets anyone with read access to the backing database recover every user's builder-API credential verbatim and impersonate that user with no password or MFA. The tokens were persisted with the plaintext value returned by generateId(24) rather than a hash, so a single database disclosure - via SQL injection, an exposed backup, or insider access - yields full account takeover across all tenants. Version 3.17.0 remediates the flaw by SHA-256 hashing tokens at rest; there is no public exploit identified at time of analysis and it is not in CISA KEV. | CRITICAL | 9.1 | 0.2% | 46 |
No patch
|
| CVE-2026-48763 | Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URLs for arbitrary object keys - including other tenants' private paths - by supplying an attacker-controlled filePath parameter to a deprecated public upload endpoint. Exploitation requires only knowledge of a valid public typebotId and blockId, both of which are typically visible in chatbot embed codes or share links. No public exploit has been confirmed at time of analysis, and this CVE does not appear in CISA KEV, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector indicates trivial remote unauthenticated exploitation against any Typebot deployment with S3 storage configured. | HIGH | 8.2 | 0.3% | 41 |
|
| CVE-2026-49213 | Server-side request forgery in Typebot before 3.17.2 lets an authenticated workspace editor or creator bypass the shared SSRF validator using the IPv6 unspecified address :: (and its expanded form), which validateIPAddress in packages/lib/src/ssrf/validateHttpReqUrl.ts fails to block. By configuring a server-side HTTP Request block or guarded script fetch, an attacker coerces the Typebot server to reach local HTTP services via safeKy, including flows reachable through startChat and continueChat endpoints. No public exploit identified at time of analysis, but the fix is confirmed in 3.17.2 and the technical root cause is documented in the vendor advisory. | HIGH | 8.1 | 0.3% | 41 |
|
| CVE-2026-48766 | Credential exfiltration in Typebot prior to 3.17.0 allows a low-privilege guest workspace member to steal decrypted OpenAI-compatible API keys by invoking the model-listing endpoint with an attacker-controlled baseUrl. The server decrypts the stored credential and forwards the secret in both the Authorization header and an explicit api-key header to whatever URL the guest supplies, effectively acting as a credential-delivery proxy. This vulnerability has no public exploit identified at time of analysis, but the attack is trivially exploitable by any authenticated workspace guest with read access. | HIGH | 7.6 | 0.3% | 38 |
|
| CVE-2026-47704 | Typebot's webhook resume endpoint exposes an insecure direct object reference flaw that allows any authenticated user holding read access to at least one typebot to inject arbitrary JSON payloads into a suspended webhook session owned by a completely different typebot on the same instance. The handler validates authorization against the caller-supplied typebotId but then resolves the session result record solely by resultId without binding it to the authorized typebot, enabling an attacker to mix a legitimately authorized typebotId and blockId with a foreign live resultId to hijack cross-tenant execution flow and advance the victim's business logic. No public exploit has been identified at time of analysis; vendor-released patch version 3.17.0 is available and resolves the flaw. | HIGH | 7.1 | 0.5% | 36 |
|
| CVE-2026-42142 | Unauthorized cross-workspace Google Sheets credential exposure in Typebot prior to version 3.17.0 allows any authenticated user to call the `POST /api/sheets/getSheets` endpoint with an arbitrary workspace ID, bypassing membership checks entirely. The handler decrypts and returns the target workspace's stored Google Sheets OAuth tokens along with spreadsheet metadata (sheet names, IDs, and column headers), constituting a direct credential theft vector against any workspace with a Google Sheets integration configured. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low exploitation complexity makes this a credible insider or multi-tenant threat. | HIGH | 7.1 | 0.3% | 36 |
|
| CVE-2026-48495 | Cross-workspace credential injection in Typebot's Google Sheets OAuth callback allows an authenticated attacker to plant Google Sheets credentials into workspaces they do not own, and - if target IDs are known - attach those credentials to blocks inside victim Typebots. The root cause is that the OAuth callback decodes and blindly trusts a client-supplied, unprotected base64 JSON state parameter without verifying the authenticated user holds write access to the referenced workspaceId or typebotId. All Typebot versions prior to 3.17.0 are affected; no public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog. | HIGH | 7.1 | 0.3% | 36 |
|
| CVE-2026-48483 | Server-Side Request Forgery (SSRF) in Typebot's WhatsApp status webhook forwarding allows an authenticated workspace user to pivot the Typebot server into probing or interacting with internal network hosts, cloud metadata endpoints, or localhost services. The vulnerability exists in all Typebot versions prior to 3.17.0 and is triggered server-side whenever the public WhatsApp webhook receives a status payload, requiring no further interaction after the malicious URL is configured. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is straightforward for any workspace member with WhatsApp integration configuration access. | MEDIUM | 5.4 | 0.3% | 27 |
|
| CVE-2026-48762 | Server-Side Request Forgery (SSRF) in Typebot's OpenAI 'Create Transcription' action handler allows authenticated users to direct the Typebot server to fetch arbitrary internal or localhost URLs via a user-supplied audio URL parameter. The unprotected `fetch()` call in `createTranscriptionHandler.ts` bypasses the `safeKy` SSRF guard used elsewhere in the codebase, enabling internal network reconnaissance with response content leaked back through the OpenAI Whisper transcription result. Versions prior to 3.16.0 are affected; the fix is confirmed released and no public exploit or CISA KEV listing exists at time of analysis. | MEDIUM | 5.4 | 0.2% | 27 |
|