CVE-2026-48765 - TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding
Brief
CVE ID : CVE-2026-48765
Published : Aug. 11, 2026, 8:37 p. m.
- 26 minutes ago
Description : TypeBot is a chatbot builder tool. Versions prior to 3.
- 0 allow a low-privilege read collaborator to extract a workspace OAuth `credentialsId` from a readable bot configuration and then overwrite that credential through `handleUpdateOAuthCredentials()` by supplying an attacker-controlled writable `workspaceId`.
The update path validates only the attacker-supplied workspace and then updates the credential record by global `id` alone, while also rewriting the credential's `workspaceId`. This allows cross-workspace OAuth credential takeover and reassignment. Version 3.
- 0 patches the issue.
Severity: 0.0
- NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...