CVE-2026-62861: TypeBot Auth Bypass Vulnerability

CVE-2026-62861 Overview

CVE-2026-62861 is an authorization flaw in Typebot, an open-source chatbot builder. Versions prior to 3.18.0 fail to verify custom domain ownership before invoking a delete operation against the shared Vercel project. Any authenticated non-guest workspace member can supply an arbitrary domain name and remove another workspace's public custom domain. The result is service disruption for typebots hosted on the targeted domain. The issue is tracked under [CWE-639] Authorization Bypass Through User-Controlled Key and is fixed in version 3.18.0.

Critical Impact
Any authenticated workspace member can delete another workspace's custom domain from the shared Vercel project, rendering typebots on that domain unreachable.

Affected Products

Typebot versions prior to 3.18.0
Self-hosted Typebot deployments using custom domains via Vercel
Typebot cloud tenants sharing the multi-tenant Vercel project

Discovery Timeline

2026-08-25 - CVE-2026-62861 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-62861

Vulnerability Analysis

The vulnerability lives in the custom-domain delete handler at apps/builder/src/features/customDomains/api/handleDeleteCustomDomain.ts. The handler accepts two client-supplied parameters: workspaceId and the domain name. It authorizes the caller against the supplied workspaceId using isWriteWorkspaceForbidden, but never confirms that the submitted name actually belongs to that workspace.

The handler then calls deleteDomainOnVercel(name) directly. Because multiple Typebot workspaces share a single Vercel project, the Vercel API removes the domain regardless of which workspace initiated the request. Typebots served from that domain immediately become unavailable.

Root Cause

The root cause is a missing ownership check between two client-controlled identifiers. The code trusts that a caller authorized for workspaceId will only submit domain names owned by that workspace. This is a textbook Insecure Direct Object Reference pattern classified as [CWE-639].

Attack Vector

Exploitation requires only a low-privilege authenticated account: any non-guest member of any workspace. The attacker sends a delete request specifying their own workspaceId (which passes the authorization check) and the victim's domain name. No user interaction is required on the victim side.

typescript

// Patch: apps/builder/src/features/customDomains/api/handleDeleteCustomDomain.ts
   if (!workspace || isWriteWorkspaceForbidden(workspace, user))
     throw new ORPCError("NOT_FOUND", { message: "Workspace not found" });
 
+  const customDomain = await prisma.customDomain.findFirst({
+    where: {
+      name,
+      workspaceId,
+    },
+    select: {
+      name: true,
+    },
+  });
+
+  if (!customDomain)
+    throw new ORPCError("NOT_FOUND", { message: "Custom domain not found" });
+
   try {
-    await deleteDomainOnVercel(name);
+    await deleteDomainOnVercel(customDomain.name);
   } catch (error) {
     console.error(error);
     if (error instanceof HTTPError)

Source: GitHub Commit 06575df. The patch queries prisma.customDomain for a record matching both name and workspaceId, and only proceeds with Vercel deletion after confirming ownership.

Detection Methods for CVE-2026-62861

Indicators of Compromise

Unexpected customDomain.delete oRPC calls originating from workspace members who do not own the domain being removed.
Sudden HTTP 404 or DNS resolution failures on typebot public domains without a corresponding administrator action.
Vercel project audit log entries showing domain removals not tied to a legitimate administrative workflow.

Detection Strategies

Correlate application-level delete events for custom domains with the authenticated userId and target workspaceId to identify mismatches.
Alert on any delete request where the workspaceId claimed by the caller does not match the workspace that originally registered the domain in the CustomDomain table.
Baseline the frequency of custom-domain deletions per workspace and flag statistical outliers.

Monitoring Recommendations

Enable verbose logging on the handleDeleteCustomDomain endpoint including caller identity, submitted workspaceId, and submitted name.
Forward Typebot application logs and Vercel API audit logs to a centralized analytics platform for cross-source correlation.
Monitor uptime of published typebot domains and alert on unexplained availability drops.

How to Mitigate CVE-2026-62861

Immediate Actions Required

Upgrade Typebot to version 3.18.0 or later on all self-hosted and managed instances.
Audit the CustomDomain table and Vercel project domain list to detect any unauthorized deletions since deployment.
Rotate or restrict workspace membership for accounts that do not require domain-management permissions.

Patch Information

The fix is included in Typebot Release v3.18.0. Full technical details are documented in GitHub Security Advisory GHSA-7h82-p425-wpmg. The patch adds a prisma.customDomain.findFirst ownership check before the Vercel delete call.

Workarounds

If patching is not immediately possible, restrict workspace membership to trusted users only, as guest accounts are not affected.
Deploy a reverse-proxy or API gateway rule that inspects delete requests and rejects those where the domain does not belong to the caller's workspace.
Temporarily disable the custom-domain delete endpoint at the ingress layer until the upgrade is applied.

bash

# Upgrade Typebot to the patched release
git fetch --tags
git checkout v3.18.0
pnpm install
pnpm build
# Restart the builder service after deployment