CVE-2026-48759 Details
Description
TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modification and deletion. The handleSaveThemeTemplate and handleDeleteThemeTemplate handlers validate that the authenticated user is a non-guest member of the provided workspaceId, but then operate on themeTemplateId via Prisma queries that do NOT include workspaceId in the WHERE clause. This allows any authenticated user to modify or delete theme templates belonging to any other workspace and may expose Template IDs via shared typebots or network traffic. This issue has been fixed in version 3.16.0.
A cross-workspace Insecure Direct Object Reference (IDOR) vulnerability has been identified in TypeBot versions through 3.15.2. This vulnerability allows authenticated users to modify or delete theme templates belonging to other workspaces. The issue arises because the handlers for saving and deleting theme templates validate the user's workspace membership but fail to restrict operations to the correct workspace. As a result, any authenticated user can manipulate theme templates across workspaces, potentially leading to unauthorized modifications or deletions.
Users can upgrade to TypeBot version 3.16.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 17, 2026CISA-ADP
Assessed Jun 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0 | [email protected] | Release NotesVendor |
| https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-qv4p-4mp3-pvpv | [email protected] | AdvisoryTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TypeBot | <= 3.15.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 18, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | [email protected] |