CVE-2026-48765: TypeBot Auth Bypass Vulnerability

CVE-2026-48765 Overview

CVE-2026-48765 is an authorization flaw in TypeBot, an open-source chatbot builder. Versions prior to 3.17.0 fail to validate credential ownership when updating OAuth credentials. A low-privilege read collaborator can extract a workspace OAuth credentialsId from a readable bot configuration and overwrite that credential through handleUpdateOAuthCredentials(). The attacker supplies a writable workspaceId they control, and the update path only validates the attacker-supplied workspace. The credential record is then updated by global id alone, reassigning the record to the attacker's workspace. This enables cross-workspace OAuth credential takeover. Version 3.17.0 patches the issue.

Critical Impact
A low-privilege read collaborator can hijack OAuth credentials from any workspace whose bot configuration they can read, enabling cross-tenant access to connected third-party services.

Affected Products

TypeBot versions prior to 3.17.0
TypeBot self-hosted deployments running vulnerable builder API
TypeBot integrations using OAuth credentials (Google Sheets, OpenAI, and other OAuth-based blocks)

Discovery Timeline

2026-08-11 - CVE-2026-48765 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-48765

Vulnerability Analysis

The vulnerability is an Authorization Bypass Through User-Controlled Key [CWE-639] in the TypeBot builder API. The handleUpdateOAuthCredentials() endpoint accepts a workspaceId parameter and a credential id. The handler checks whether the caller has write access to the supplied workspaceId, but it never verifies that the target credential actually belongs to that workspace. The credential lookup and update operate on the global id alone. As part of the update, the credential's workspaceId field is overwritten with the attacker-supplied value, reassigning ownership to the attacker's workspace.

A low-privilege read collaborator on a victim workspace can enumerate credentialsId values from any bot configuration they can read. The attacker then invokes the update endpoint with the victim's credentialsId and their own writable workspaceId. The result is full takeover of OAuth tokens for services such as Google Sheets and OpenAI connected to the victim workspace.

Root Cause

The root cause is missing object-level authorization on the credential record. The update path validates permissions on the attacker-supplied workspace rather than on the credential's actual owning workspace. The patch replaces isReadWorkspaceFobidden with isWriteWorkspaceForbidden in the affected handlers and removes the ability to rewrite a credential's workspaceId during update.

Attack Vector

Exploitation requires network access to the TypeBot builder API and a low-privilege authenticated account with read access on any bot referencing the target credential. No user interaction is needed. The attacker must also control a workspace where they hold write permission to receive the reassigned credential.

typescript

// Patch excerpt: apps/builder/src/features/blocks/integrations/googleSheets/api/handleGetAccessToken.ts
 import type { User } from "@typebot.io/user/schemas";
 import { OAuth2Client } from "google-auth-library";
 import { z } from "zod";
-import { isReadWorkspaceFobidden } from "@/features/workspace/helpers/isReadWorkspaceFobidden";
+import { isWriteWorkspaceForbidden } from "@/features/workspace/helpers/isWriteWorkspaceForbidden";

 export const getAccessTokenInputSchema = z.object({
   workspaceId: z.string(),

Source: GitHub Commit 7ae4c00. The patch tightens the authorization check from read-level to write-level and is mirrored across integration handlers such as handleListModels.ts for OpenAI.

Detection Methods for CVE-2026-48765

Indicators of Compromise

Unexpected changes to the workspaceId field on OAuth credential records in the TypeBot database.
Calls to handleUpdateOAuthCredentials() where the credential's prior workspaceId differs from the request body workspaceId.
OAuth token usage from workspaces or users that historically never accessed the connected third-party service.

Detection Strategies

Audit TypeBot database credential tables for records whose workspaceId has changed and correlate against builder API access logs.
Instrument the builder API to log the tuple (callerUserId, credentialId, oldWorkspaceId, newWorkspaceId) on every credential update and alert on cross-workspace reassignment.
Review third-party OAuth provider logs (Google, OpenAI) for token use from unexpected TypeBot workspace identifiers or hosts.

Monitoring Recommendations

Enable request logging on the TypeBot builder tRPC/API layer and forward logs to a centralized SIEM for correlation.
Monitor for low-privilege collaborators issuing write operations against credential endpoints.
Track OAuth refresh and access token issuance rates per workspace and alert on statistical anomalies.

How to Mitigate CVE-2026-48765

Immediate Actions Required

Upgrade TypeBot to version 3.17.0 or later on all self-hosted deployments.
Rotate all OAuth credentials stored in TypeBot workspaces, including Google Sheets, OpenAI, and any other OAuth-integrated services.
Review workspace collaborator memberships and revoke unnecessary read access to bots that reference sensitive credentials.
Audit credential records for unauthorized workspaceId reassignments since the vulnerable version was deployed.

Patch Information

The fix is included in TypeBot Release v3.17.0. The corresponding code changes are in Pull Request #2459 and Commit 7ae4c00. Full details are published in GitHub Security Advisory GHSA-3788-7276-x4j4.

Workarounds

Restrict workspace collaborator invitations and remove low-trust users from workspaces containing OAuth credentials until the patch is applied.
Place the TypeBot builder API behind network controls that limit access to trusted operators.
Disable or remove OAuth-integrated blocks (Google Sheets, OpenAI) from workspaces where read-collaborator exposure cannot be reduced.

bash

# Upgrade self-hosted TypeBot to the patched release
git fetch --tags
git checkout v3.17.0
docker compose pull
docker compose up -d