CVE-2026-48767

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper `getAccessToken`. The vulnerable path checks only whether the caller has read access to the workspace, decrypts the stored Google OAuth credential, refreshes or retrieves the access token through the Google client, and returns the raw bearer token directly to the caller. Because guest members can also enumerate credential identifiers, a guest can mint and reuse the workspace's Google access token outside Typebot. Version 3.17.0 patches the issue.

• CWE-200

• https://github.com/baptisteArno/typebot.io/commit/c0ffd825e2f4ee2256a157fd085fb624dcede625
• https://github.com/baptisteArno/typebot.io/pull/2501
• https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0
• https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qjpp-9cqc-jhh8
• https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qjpp-9cqc-jhh8

Published

Aug 11, 2026

Last Modified

Aug 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48761Symfony is a PHP framework for web and console applications …6.1
• CVE-2026-48762TypeBot is a chatbot builder tool. Prior to version 3.16.0, …5.4
• CVE-2026-48763TypeBot is a chatbot builder tool. Versions prior to 3.17.0 …8.2
• CVE-2026-48764TypeBot is a chatbot builder tool. In versions prior to 3.17…8.2
• CVE-2026-48765TypeBot is a chatbot builder tool. Versions prior to 3.17.0 …9.9
• CVE-2026-48766TypeBot is a chatbot builder tool. Versions prior to 3.17.0 …7.6
• CVE-2026-48768TypeBot is a chatbot builder tool. In versions 3.16.1 and ea…9.3
• CVE-2026-4877A security flaw has been discovered in itsourcecode Payroll …4.3
• CVE-2026-48770Notepad++ is a free and open-source source code editor. Prio…5
• CVE-2026-48771ishankportfolio is a portfolio website. Prior to version 1.0…8.2
• CVE-2026-48772ProxySQL is a proxy for MySQL and its forks, as well as Post…10
• CVE-2026-48773ProxySQL is a proxy for MySQL and its forks, as well as Post…9.8