CVE-2026-48763: TypeBot Information Disclosure Flaw

CVE-2026-48763 Overview

CVE-2026-48763 is a missing authorization vulnerability [CWE-862] in TypeBot, an open-source chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url. The endpoint accepts an attacker-controlled filePath parameter and returns a presigned Amazon S3 PUT URL for that exact key. Unauthenticated attackers who know a valid public typebotId and blockId can request presigned upload URLs for arbitrary objects in the shared S3 bucket. This includes private/... paths and other tenants' public/... paths, enabling cross-tenant data tampering.

Critical Impact
Unauthenticated attackers can overwrite arbitrary S3 objects across tenants in the shared bucket, corrupting private and public assets belonging to other TypeBot users.

Affected Products

TypeBot versions prior to 3.17.0
Self-hosted TypeBot deployments using shared S3 storage
Multi-tenant TypeBot instances exposing public typebots

Discovery Timeline

2026-08-11 - CVE-2026-48763 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-48763

Vulnerability Analysis

The vulnerability resides in the deprecated public upload endpoint responsible for issuing presigned S3 upload URLs to end users interacting with file input blocks. TypeBot uses presigned URLs so browser clients can upload files directly to S3 without proxying through the application server. The endpoint validates only that the typebotId corresponds to a public typebot and that the blockId matches a file input block. It fails to validate that the supplied filePath belongs to the tenant or namespace associated with that typebot.

This missing authorization check [CWE-862] enables attackers to pass arbitrary key paths and receive valid presigned PUT URLs for those keys. Once the attacker holds a presigned URL, they can write to any object in the shared bucket, including private tenant assets and other users' public assets.

Root Cause

The root cause is a broken access control decision in the presigned URL generator. The handler trusts the client-supplied filePath and derives no path constraint from the authenticated context or the resolved typebotId. Because presigned URLs are cryptographically bound to the exact key requested, whatever path the client sends is exactly what the client can subsequently write.

Attack Vector

An unauthenticated remote attacker enumerates or obtains a public typebotId and its associated file input blockId. Both identifiers are exposed through normal chatbot interaction. The attacker then issues a GET request to the vulnerable endpoint with a crafted filePath targeting another tenant's namespace or a private/ prefix. The server returns a presigned PUT URL. The attacker uses that URL to overwrite the target object with attacker-controlled content, including malicious HTML, JavaScript, or replaced media that will be served to legitimate visitors.

typescript

// Patch excerpt: credential access control hardening shipped alongside the
// removal of the vulnerable S3 upload endpoint in TypeBot 3.17.0.
 import type { User } from "@typebot.io/user/schemas";
 import { OAuth2Client } from "google-auth-library";
 import { z } from "zod";
-import { isReadWorkspaceFobidden } from "@/features/workspace/helpers/isReadWorkspaceFobidden";
+import { isWriteWorkspaceForbidden } from "@/features/workspace/helpers/isWriteWorkspaceForbidden";

 export const getAccessTokenInputSchema = z.object({
   workspaceId: z.string(),

Source: GitHub Commit 7ae4c00

Detection Methods for CVE-2026-48763

Indicators of Compromise

Requests to GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url containing filePath values referencing private/ prefixes or unrelated tenant identifiers.
S3 access logs showing PUT operations against object keys that do not match the typebotId bound to the issuing session.
Unexpected modifications to public/ assets, particularly HTML, JavaScript, or image files hosted for other tenants.
Presigned URL issuance from unauthenticated sessions targeting keys outside the requesting typebot's namespace.

Detection Strategies

Parse application logs for high-volume or scripted requests to the deprecated upload-url endpoint from single source IPs.
Correlate presigned URL issuance events with subsequent S3 PUT operations to detect path mismatches.
Alert on any filePath parameter containing ../, private/, or tenant identifiers not tied to the requesting session.
Enable AWS CloudTrail data events for the S3 bucket and flag writes originating from presigned URLs tied to public typebots.

Monitoring Recommendations

Ingest TypeBot application logs and S3 access logs into a central analytics platform for cross-source correlation.
Monitor for object overwrites on tenant-critical prefixes and trigger integrity checks against known-good hashes.
Track version counts on affected S3 objects; enable S3 Object Versioning to preserve original content if tampering occurs.

How to Mitigate CVE-2026-48763

Immediate Actions Required

Upgrade TypeBot to version 3.17.0 or later, which removes the vulnerable endpoint entirely.
Audit the shared S3 bucket for unauthorized object modifications since the affected endpoint was reachable.
Rotate any credentials, tokens, or secrets that may have been stored in overwritten configuration objects.
Enable S3 Object Versioning and Object Lock where feasible to prevent destructive overwrites.

Patch Information

The fix is included in TypeBot Release v3.17.0. The vulnerable presigned upload endpoint was removed as part of Pull Request #2459 via commit 7ae4c00. Full details are documented in GitHub Security Advisory GHSA-m7f5-3wcm-x2c4.

Workarounds

Block requests to /api/v1/typebots/*/blocks/*/storage/upload-url at the reverse proxy or Web Application Firewall (WAF) if immediate upgrade is not possible.
Restrict the S3 IAM role used by TypeBot to enforce key-prefix conditions that scope writes to the intended tenant namespace.
Isolate tenants into separate S3 buckets or key prefixes with per-tenant IAM boundaries to limit cross-tenant blast radius.

bash

# Nginx snippet to block the deprecated upload-url endpoint until upgrade
location ~ ^/api/v1/typebots/[^/]+/blocks/[^/]+/storage/upload-url$ {
    return 403;
}