CVE-2026-48495

{
  "id": "CVE-2026-48495",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-11T16:17:32.170",
  "lastModified": "2026-10-23T19:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON `state` parameter and trusts the embedded `workspaceId`, `typebotId`, `blockId`, and `redirectUrl` without cryptographic integrity protection or authorization checks. The callback route is authenticated, but it does not verify that the authenticated user has write access to the target workspace or Typebot before creating credentials in the workspace or updating Typebot groups. An authenticated user who can obtain a valid Google OAuth `code` can alter the `state` value to create Google Sheets credentials in another workspace and, if target IDs are known, attach those credentials to a block in another Typebot. Version 3.17.0 patches the issue."
    },
    {
      "lang": "es",
      "value": "TypeBot es una herramienta de creación de chatbots. Antes de la versión 3.17.0, la devolución de llamada de OAuth de Google Sheets decodifica un parámetro ’state’ JSON codificado en base64 y confía en los ’workspaceId’, ’typebotId’, ’blockId’ y ’redirectUrl’ incrustados sin protección de integridad criptográfica ni comprobaciones de autorización. La ruta de devolución de llamada está autenticada, pero no verifica que el usuario autenticado tenga acceso de escritura al espacio de trabajo o Typebot de destino antes de crear credenciales en el espacio de trabajo o actualizar grupos de Typebot. Un usuario autenticado que puede obtener un ’code’ de OAuth de Google válido puede alterar el valor de ’state’ para crear credenciales de Google Sheets en otro espacio de trabajo y, si se conocen los ID de destino, adjuntar esas credenciales a un bloque en otro Typebot. La versión 3.17.0 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "baptisteArno",
          "product": "typebot.io",
          "versions": [
            {
              "version": "< 3.17.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-13T14:41:43.888044Z",
          "id": "CVE-2026-48495",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/baptisteArno/typebot.io/commit/c0ffd825e2f4ee2256a157fd085fb624dcede625",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/baptisteArno/typebot.io/pull/2501",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-w789-9gxq-2xcj",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-w789-9gxq-2xcj",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}