Vulnerability-Lookup

CVE-2026-39968 (GCVE-0-2026-39968)

Vulnerability from cvelistv5 – Published: 2026-05-22 18:26 – Updated: 2026-05-26 13:08

Title

TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint

Summary

TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the fix for GHSA-4xc5-wfwc-jw47 ("Credential Theft via Client-Side Script Execution and API Authorization Bypass") is incomplete. While the builder's getCredentials tRPC endpoint was patched with workspace membership checks, the bot-engine runtime still allows any authenticated user to use credentials from any workspace via the preview chat endpoint. The bot-engine's getCredentials() utility function uses a falsy check (if (workspaceId && ...)) for workspace ownership validation. Since the preview endpoint accepts a client-controlled workspaceId field and the Zod schema allows empty strings, an attacker can supply workspaceId: "" to bypass credential ownership verification entirely. Exploitation can result in credential exfiltration, external service abuse, financial damage and a data breach.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-284 - Improper Access Control
CWE-522 - Insufficiently Protected Credentials
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/baptisteArno/typebot.io/securi…	x_refsource_CONFIRM
https://github.com/baptisteArno/typebot.io/commit…	x_refsource_MISC
https://github.com/baptisteArno/typebot.io/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
baptisteArno	typebot.io	Affected: < 3.16.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-39968",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-26T13:08:55.483789Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-26T13:08:58.498Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-cq66-9cwr-x8jr"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "typebot.io",
          "vendor": "baptisteArno",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.16.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the fix for GHSA-4xc5-wfwc-jw47 (\"Credential Theft via Client-Side Script Execution and API Authorization Bypass\") is incomplete. While the builder\u0027s getCredentials tRPC endpoint was patched with workspace membership checks, the bot-engine runtime still allows any authenticated user to use credentials from any workspace via the preview chat endpoint. The bot-engine\u0027s getCredentials() utility function uses a falsy check (if (workspaceId \u0026\u0026 ...)) for workspace ownership validation. Since the preview endpoint accepts a client-controlled workspaceId field and the Zod schema allows empty strings, an attacker can supply workspaceId: \"\" to bypass credential ownership verification entirely. Exploitation can result in credential exfiltration, external service abuse, financial damage and a data breach."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522: Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-22T18:26:55.446Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-cq66-9cwr-x8jr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-cq66-9cwr-x8jr"
        },
        {
          "name": "https://github.com/baptisteArno/typebot.io/commit/d96f572e6099c5f622c05ba7b8634e6477dcf052",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/baptisteArno/typebot.io/commit/d96f572e6099c5f622c05ba7b8634e6477dcf052"
        },
        {
          "name": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0"
        }
      ],
      "source": {
        "advisory": "GHSA-cq66-9cwr-x8jr",
        "discovery": "UNKNOWN"
      },
      "title": "TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-39968",
    "datePublished": "2026-05-22T18:26:55.446Z",
    "dateReserved": "2026-04-08T00:01:47.627Z",
    "dateUpdated": "2026-05-26T13:08:58.498Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-39968",
      "date": "2026-07-24",
      "epss": "0.00271",
      "percentile": "0.19029"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-39968\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-22T19:17:03.373\",\"lastModified\":\"2026-07-23T16:10:00.137\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the fix for GHSA-4xc5-wfwc-jw47 (\\\"Credential Theft via Client-Side Script Execution and API Authorization Bypass\\\") is incomplete. While the builder\u0027s getCredentials tRPC endpoint was patched with workspace membership checks, the bot-engine runtime still allows any authenticated user to use credentials from any workspace via the preview chat endpoint. The bot-engine\u0027s getCredentials() utility function uses a falsy check (if (workspaceId \u0026\u0026 ...)) for workspace ownership validation. Since the preview endpoint accepts a client-controlled workspaceId field and the Zod schema allows empty strings, an attacker can supply workspaceId: \\\"\\\" to bypass credential ownership verification entirely. Exploitation can result in credential exfiltration, external service abuse, financial damage and a data breach.\"},{\"lang\":\"es\",\"value\":\"TypeBot es una herramienta de creaci\u00f3n de chatbots. En las versiones 3.15.2 y anteriores, la soluci\u00f3n para GHSA-4xc5-wfwc-jw47 (\u0027Robo de credenciales mediante ejecuci\u00f3n de scripts del lado del cliente y omisi\u00f3n de autorizaci\u00f3n de API\u0027) est\u00e1 incompleta. Aunque el endpoint tRPC getCredentials del constructor fue parcheado con verificaciones de membres\u00eda de espacio de trabajo, el tiempo de ejecuci\u00f3n del motor de bots a\u00fan permite a cualquier usuario autenticado usar credenciales de cualquier espacio de trabajo a trav\u00e9s del endpoint de chat de vista previa. La funci\u00f3n de utilidad getCredentials() del motor de bots utiliza una verificaci\u00f3n falsy (si (workspaceId \u0026\u0026 ...)) para la validaci\u00f3n de la propiedad del espacio de trabajo. Dado que el endpoint de vista previa acepta un campo workspaceId controlado por el cliente y el esquema Zod permite cadenas vac\u00edas, un atacante puede proporcionar workspaceId: \u0027\u0027 para omitir completamente la verificaci\u00f3n de propiedad de credenciales. La explotaci\u00f3n puede resultar en exfiltraci\u00f3n de credenciales, abuso de servicios externos, da\u00f1os financieros y una violaci\u00f3n de datos.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"baptisteArno\",\"product\":\"typebot.io\",\"versions\":[{\"version\":\"\u003c 3.16.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":4.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-26T13:08:55.483789Z\",\"id\":\"CVE-2026-39968\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"},{\"lang\":\"en\",\"value\":\"CWE-522\"},{\"lang\":\"en\",\"value\":\"CWE-639\"}]}],\"references\":[{\"url\":\"https://github.com/baptisteArno/typebot.io/commit/d96f572e6099c5f622c05ba7b8634e6477dcf052\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-cq66-9cwr-x8jr\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-cq66-9cwr-x8jr\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-05-26T14:12:21+00:00",
      "cve": "CVE-2026-39968",
      "id": "CVE-2026-39968",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39968.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-39968\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-26T13:08:55.483789Z\"}}}], \"references\": [{\"url\": \"https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-cq66-9cwr-x8jr\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-26T13:08:44.051Z\"}}], \"cna\": {\"title\": \"TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint\", \"source\": {\"advisory\": \"GHSA-cq66-9cwr-x8jr\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"baptisteArno\", \"product\": \"typebot.io\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3.16.0\"}]}], \"references\": [{\"url\": \"https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-cq66-9cwr-x8jr\", \"name\": \"https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-cq66-9cwr-x8jr\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/baptisteArno/typebot.io/commit/d96f572e6099c5f622c05ba7b8634e6477dcf052\", \"name\": \"https://github.com/baptisteArno/typebot.io/commit/d96f572e6099c5f622c05ba7b8634e6477dcf052\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0\", \"name\": \"https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the fix for GHSA-4xc5-wfwc-jw47 (\\\"Credential Theft via Client-Side Script Execution and API Authorization Bypass\\\") is incomplete. While the builder\u0027s getCredentials tRPC endpoint was patched with workspace membership checks, the bot-engine runtime still allows any authenticated user to use credentials from any workspace via the preview chat endpoint. The bot-engine\u0027s getCredentials() utility function uses a falsy check (if (workspaceId \u0026\u0026 ...)) for workspace ownership validation. Since the preview endpoint accepts a client-controlled workspaceId field and the Zod schema allows empty strings, an attacker can supply workspaceId: \\\"\\\" to bypass credential ownership verification entirely. Exploitation can result in credential exfiltration, external service abuse, financial damage and a data breach.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-284\", \"description\": \"CWE-284: Improper Access Control\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-522\", \"description\": \"CWE-522: Insufficiently Protected Credentials\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-639\", \"description\": \"CWE-639: Authorization Bypass Through User-Controlled Key\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-22T18:26:55.446Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-39968\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-26T13:08:58.498Z\", \"dateReserved\": \"2026-04-08T00:01:47.627Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-22T18:26:55.446Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-39968

Vulnerability from fkie_nvd - Published: 2026-05-22 19:17 - Updated: 2026-06-17 10:42

Severity

7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/baptisteArno/typebot.io/commit/d96f572e6099c5f622c05ba7b8634e6477dcf052
	security-advisories@github.com	https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0
	security-advisories@github.com	https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-cq66-9cwr-x8jr
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-cq66-9cwr-x8jr

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "typebot.io",
          "vendor": "baptisteArno",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.16.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the fix for GHSA-4xc5-wfwc-jw47 (\"Credential Theft via Client-Side Script Execution and API Authorization Bypass\") is incomplete. While the builder\u0027s getCredentials tRPC endpoint was patched with workspace membership checks, the bot-engine runtime still allows any authenticated user to use credentials from any workspace via the preview chat endpoint. The bot-engine\u0027s getCredentials() utility function uses a falsy check (if (workspaceId \u0026\u0026 ...)) for workspace ownership validation. Since the preview endpoint accepts a client-controlled workspaceId field and the Zod schema allows empty strings, an attacker can supply workspaceId: \"\" to bypass credential ownership verification entirely. Exploitation can result in credential exfiltration, external service abuse, financial damage and a data breach."
    }
  ],
  "id": "CVE-2026-39968",
  "lastModified": "2026-06-17T10:42:49.843",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-39968",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-26T13:08:55.483789Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-22T19:17:03.373",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/baptisteArno/typebot.io/commit/d96f572e6099c5f622c05ba7b8634e6477dcf052"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-cq66-9cwr-x8jr"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-cq66-9cwr-x8jr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        },
        {
          "lang": "en",
          "value": "CWE-522"
        },
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-39968 (GCVE-0-2026-39968)

FKIE_CVE-2026-39968

Tags

Sightings

Nomenclature