CVE-2026-48759

TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modification and deletion. The handleSaveThemeTemplate and handleDeleteThemeTemplate handlers validate that the authenticated user is a non-guest member of the provided workspaceId, but then operate on themeTemplateId via Prisma queries that do NOT include workspaceId in the WHERE clause. This allows any authenticated user to modify or delete theme templates belonging to any other workspace and may expose Template IDs via shared typebots or network traffic. This issue has been fixed in version 3.16.0.

• CWE-639

• https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0
• https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qv4p-4mp3-pvpv

Published

Jun 17, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48745Traccar Client is a GPS tracking mobile app for sending loca…9.3
• CVE-2026-48746vLLM is an inference and serving engine for large language m…9.1
• CVE-2026-48747Symfony is a PHP framework for web and console applications …5.3
• CVE-2026-48748Netty is a network application framework for development of …7.5
• CVE-2026-4875A vulnerability was determined in itsourcecode Free Hotel Re…4.7
• CVE-2026-48758sigstore-js provides JavaScript libraries for interacting wi…5.4
• CVE-2026-4876A vulnerability was identified in itsourcecode Free Hotel Re…6.3
• CVE-2026-48760Symfony is a PHP framework for web and console applications …6.1
• CVE-2026-48761Symfony is a PHP framework for web and console applications …6.1
• CVE-2026-48762TypeBot is a chatbot builder tool. Prior to version 3.16.0, …5.4
• CVE-2026-48763TypeBot is a chatbot builder tool. Versions prior to 3.17.0 …8.2
• CVE-2026-48764TypeBot is a chatbot builder tool. In versions prior to 3.17…8.2