CVE-2026-48767

{
  "id": "CVE-2026-48767",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-11T18:17:33.470",
  "lastModified": "2026-10-23T19:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper `getAccessToken`. The vulnerable path checks only whether the caller has read access to the workspace, decrypts the stored Google OAuth credential, refreshes or retrieves the access token through the Google client, and returns the raw bearer token directly to the caller. Because guest members can also enumerate credential identifiers, a guest can mint and reuse the workspace's Google access token outside Typebot. Version 3.17.0 patches the issue."
    },
    {
      "lang": "es",
      "value": "TypeBot es una herramienta de creación de chatbots. Las versiones anteriores a la 3.17.0 permiten a un miembro invitado con pocos privilegios de un espacio de trabajo obtener un token de acceso OAuth de Google Sheets activo para ese espacio de trabajo al llamar a la función auxiliar de Google Sheets ’getAccessToken’. La ruta vulnerable verifica únicamente si el llamador tiene acceso de lectura al espacio de trabajo, descifra la credencial OAuth de Google almacenada, actualiza o recupera el token de acceso a través del cliente de Google y devuelve el token portador (bearer token) sin procesar directamente al llamador. Dado que los miembros invitados también pueden enumerar los identificadores de credenciales, un invitado puede acuñar y reutilizar el token de acceso de Google del espacio de trabajo fuera de Typebot. La versión 3.17.0 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "baptisteArno",
          "product": "typebot.io",
          "versions": [
            {
              "version": "< 3.17.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T17:44:40.760742Z",
          "id": "CVE-2026-48767",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/baptisteArno/typebot.io/commit/c0ffd825e2f4ee2256a157fd085fb624dcede625",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/baptisteArno/typebot.io/pull/2501",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qjpp-9cqc-jhh8",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qjpp-9cqc-jhh8",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}