CVE-2026-48494

TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session that belongs to a different typebot by mixing an authorized `typebotId` and `blockId` and a foreign preview phone number tied to another preview session. The WhatsApp test-webhook handler authorizes the parent typebot first, but then resolves the preview chat session only by `wa-preview-{phone}`. As a result, an attacker can inject arbitrary webhook JSON into another workspace's WhatsApp preview session and advance its draft/unpublished flow without any access to the victim typebot. Version 3.17.0 patches the issue.

• CWE-639

• https://github.com/baptisteArno/typebot.io/commit/36a618610174fd168fb255d9c8ecc0d2cf61a192
• https://github.com/baptisteArno/typebot.io/pull/2499
• https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0
• https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-fqf7-mmp5-j3jq
• https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-fqf7-mmp5-j3jq

Published

Aug 11, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48489Symfony is a PHP framework for web and console applications …7.5
• CVE-2026-4849A vulnerability was identified in code-projects Simple Laund…6.1
• CVE-2026-48490ArduinoCore-avr contains the source code and configuration f…6.9
• CVE-2026-48491Traefik is an HTTP reverse proxy and load balancer. From 3.7…10
• CVE-2026-48492Snipe-IT is an IT asset/license management system. Prior to …6.5
• CVE-2026-48493Snipe-IT is an IT asset/license management system. In versio…5.5
• CVE-2026-48495TypeBot is a chatbot builder tool. Prior to version 3.17.0, …7.1
• CVE-2026-48496OpenTelemetry eBPF Profiler is a production-scale agent for …6.2
• CVE-2026-48497Envoy is an open source edge and service proxy designed for …7.5
• CVE-2026-48499Activepieces is an open source AI workflow automation platfo…9.3
• CVE-2026-4850A security flaw has been discovered in code-projects Simple …9.8
• CVE-2026-48500Filament is a collection of full-stack components for accele…6.5