CVE-2026-48767: TypeBot Information Disclosure Flaw

CVE-2026-48767 Overview

CVE-2026-48767 is an information disclosure vulnerability in TypeBot, an open-source chatbot builder. Versions prior to 3.17.0 expose live Google Sheets OAuth access tokens to low-privilege guest members of a workspace. The getAccessToken helper checks only workspace read access before decrypting the stored Google OAuth credential and returning the raw bearer token. Guest members can enumerate credential identifiers and mint or reuse the workspace's Google access token outside TypeBot. The issue is tracked as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and is patched in TypeBot 3.17.0.

Critical Impact
A workspace guest member can extract a live Google OAuth bearer token, gaining out-of-band access to the workspace owner's linked Google Sheets data.

Affected Products

TypeBot self-hosted and cloud deployments prior to version 3.17.0
TypeBot Google Sheets integration handler (getAuthorizedGoogleSheetsOAuthResources)
Any workspace with guest members and a linked Google Sheets OAuth credential

Discovery Timeline

2026-08-11 - CVE-2026-48767 published to NVD
2026-08-11 - Last updated in NVD database
Patch released in TypeBot v3.17.0 via pull request #2501

Technical Details for CVE-2026-48767

Vulnerability Analysis

TypeBot integrates with Google Sheets through OAuth 2.0. Workspace owners authorize TypeBot, and the resulting refresh and access tokens are encrypted and stored per workspace. The Google Sheets helper getAccessToken retrieves the stored credential, refreshes it through the Google client, and returns the raw bearer token to the calling API path.

The vulnerable authorization check gated this endpoint on workspace read access only. Guest members are granted read access by design in TypeBot workspaces. Because guest members can also enumerate credential identifiers, an attacker who is invited into a workspace as a guest can request the OAuth token for any Google Sheets credential in that workspace.

Once the raw bearer token is returned, it can be reused outside TypeBot against sheets.googleapis.com and, depending on scopes granted at authorization time, adjacent Google APIs. The exposure represents an authorization boundary failure classified as [CWE-200].

Root Cause

The root cause is missing write-level authorization on a sensitive credential resource. The pre-patch handler only verified workspace membership rather than requiring write access to the workspace or the associated typebot before releasing the decrypted OAuth token.

Attack Vector

An authenticated guest member of a target TypeBot workspace enumerates credential IDs, then calls the Google Sheets OAuth resource endpoint referencing a chosen credential. The server responds with a live access token that the attacker uses directly against Google APIs from outside TypeBot.

typescript

// Patch: apps/builder/src/features/blocks/integrations/googleSheets/api/
// getAuthorizedGoogleSheetsOAuthResources.ts
// Fix Google Sheets OAuth callback authorization (#2501)

import { ORPCError } from "@orpc/server";
import prisma from "@typebot.io/prisma";
import type { User } from "@typebot.io/user/schemas";
import { isWriteTypebotForbidden } from "@/features/typebot/helpers/isWriteTypebotForbidden";
import { isWriteWorkspaceForbidden } from "@/features/workspace/helpers/isWriteWorkspaceForbidden";

export const getAuthorizedGoogleSheetsOAuthResources = async ({
  workspaceId,
  typebotId,
  user,
}: {
  workspaceId: string;
  typebotId?: string;
  user: Pick<User, "id">;
}) => {
  const workspace = await prisma.workspace.findFirst({
    where: { id: workspaceId },
    select: {
      id: true,
      members: { select: { userId: true, role: true } },
    },
  });

  if (!workspace || isWriteWorkspaceForbidden(workspace, user))
    throw new ORPCError("NOT_FOUND", { message: "Workspace not found" });

  if (!typebotId) return { workspace, typebot: null };
};
// Source: https://github.com/baptisteArno/typebot.io/commit/c0ffd825e2f4ee2256a157fd085fb624dcede625

The patch replaces the read-only membership check with isWriteWorkspaceForbidden and isWriteTypebotForbidden, denying access to guest members. A companion change introduces a signed googleSheetsOAuthState cookie using HMAC-signed state with a 10-minute lifetime to bind the OAuth callback to the initiating user.

Detection Methods for CVE-2026-48767

Indicators of Compromise

Requests to TypeBot Google Sheets OAuth resource endpoints originating from user accounts with the guest role
Google Workspace audit log entries showing API calls to sheets.googleapis.com from IP addresses that do not match the workspace owner's usual TypeBot infrastructure
Access token usage against Google APIs outside of documented TypeBot flow blocks or scheduled runs

Detection Strategies

Review TypeBot application logs for calls to getAuthorizedGoogleSheetsOAuthResources or getAccessToken correlated with guest-role user IDs
Cross-reference Google Cloud audit logs against expected TypeBot execution windows to identify anomalous token reuse
Enumerate workspaces with active Google Sheets credentials and non-owner guest members as high-risk exposure candidates

Monitoring Recommendations

Enable Google Workspace Admin token and login audit log streaming to a central SIEM for continuous review
Alert on OAuth access tokens used from user agents or source IPs outside the TypeBot deployment egress range
Track workspace membership changes, especially guest invitations to workspaces that hold third-party OAuth credentials

How to Mitigate CVE-2026-48767

Immediate Actions Required

Upgrade TypeBot to version 3.17.0 or later on all self-hosted deployments
Revoke and re-authorize the Google Sheets OAuth connection for any workspace that had guest members while running a vulnerable version
Audit workspace membership and remove guest accounts that no longer require access to sensitive integrations

Patch Information

The fix is delivered in TypeBot v3.17.0 through pull request #2501 and commit c0ffd825. See the GitHub Security Advisory GHSA-qjpp-9cqc-jhh8 for the vendor's full description.

Workarounds

Remove all guest members from workspaces that contain Google Sheets OAuth credentials until patching is complete
Rotate the Google OAuth client secret and disconnect the Google Sheets integration until TypeBot 3.17.0 is deployed
Restrict OAuth scopes granted to TypeBot in the Google Cloud project to the minimum required spreadsheet ranges

bash

# Upgrade a self-hosted TypeBot deployment to the patched release
git fetch --tags
git checkout v3.17.0

# Docker Compose deployments
docker compose pull
docker compose up -d --force-recreate

# Revoke the exposed Google OAuth grant for the affected workspace
# (perform in the Google Account of the credential owner):
#   https://myaccount.google.com/permissions