CVE-2026-48759

{
  "id": "CVE-2026-48759",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-17T23:17:04.173",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modification and deletion. The handleSaveThemeTemplate and handleDeleteThemeTemplate handlers validate that the authenticated user is a non-guest member of the provided workspaceId, but then operate on themeTemplateId via Prisma queries that do NOT include workspaceId in the WHERE clause. This allows any authenticated user to modify or delete theme templates belonging to any other workspace and may expose Template IDs via shared typebots or network traffic. This issue has been fixed in version 3.16.0."
    },
    {
      "lang": "es",
      "value": "TypeBot es una herramienta de creación de chatbots. Las versiones 3.15.2 e inferiores tienen una vulnerabilidad de Referencia Directa Insegura a Objeto a través de la modificación y eliminación de Plantillas de Tema entre espacios de trabajo. Los manejadores handleSaveThemeTemplate y handleDeleteThemeTemplate validan que el usuario autenticado es un miembro no invitado del workspaceId proporcionado, pero luego operan sobre themeTemplateId a través de consultas de Prisma que NO incluyen workspaceId en la cláusula WHERE. Esto permite a cualquier usuario autenticado modificar o eliminar plantillas de temas pertenecientes a cualquier otro espacio de trabajo y puede exponer IDs de Plantilla a través de typebots compartidos o tráfico de red. Este problema ha sido solucionado en la versión 3.16.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "baptisteArno",
          "product": "typebot.io",
          "versions": [
            {
              "version": "< 3.16.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-18T12:47:24.308701Z",
          "id": "CVE-2026-48759",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qv4p-4mp3-pvpv",
      "source": "[email protected]"
    }
  ]
}